TrymeLocker Winlogon Shell and Userinit Hijacking by Non-SYSTEM Process

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects unauthorized modifications to the Winlogon registry keys 'Shell' and 'Userinit'. These keys are commonly abused by adversaries to achieve persistence by executing malicious binaries or scripts upon user logon. The rule excludes modifications by the SYSTEM account and flags deviations from standard Windows configuration values (e.g., non-standard Shell values, or Userinit values that do not point to the expected system file).