Winlogon Shell Registry Value Modified to Launch Non-Explorer Binary

Subhankar H@Andrewsec57

•updated Jul 6, 2026•0•0•4

Detects modifications to the 'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell' registry value. Attackers often modify this value to execute arbitrary malicious binaries or scripts upon user logon as a persistence mechanism, replacing the default 'explorer.exe'.