TOKYOCORE Winlogon Shell/Userinit hijack and Notify DLL persistence

Subhankar H@Andrewsec57

•updated Jul 27, 2026•1•0•13

Detects potential persistence attempts by monitoring suspicious modifications to Windows Winlogon registry keys, specifically targeting Shell, Userinit, GinaDLL, and Notify subkeys associated with the TOKYOCORE malware.