TrymeLocker Winlogon Shell/Userinit Modification for Logon Persistence

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects modifications to the Winlogon Shell or Userinit registry keys. These keys define the processes that run upon user logon. Adversaries modify these values to achieve persistence by pointing them to malicious binaries or scripts, often identified in this rule by the string 'win_guard_'.