Winlogon Userinit Value Modified with Extra Comma-Separated Executable Path
Detects modifications to the Windows Registry 'Winlogon\Userinit' key where the value contains double commas. This pattern is commonly used by attackers to append a malicious executable or script path to the legitimate 'userinit.exe' process, causing the malicious code to execute during every system startup or user logon.
Sigma
