Uncommon Userinit Child Process

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•0

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.