NoEscape Winlogon Userinit Registry Persistence
Detects modifications to the Windows Registry 'Userinit' value under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'. Adversaries may modify this value to execute arbitrary malicious code automatically during user logon, establishing persistence.
Sigma
