Winlogon Shell value appended with extra executable (KNTRAT conhost.exe)
Detects modifications to the Windows Winlogon Shell registry key where the value contains explorer.exe followed by an additional executable path (such as conhost.exe), which is a common persistence mechanism used by adversaries.
Microsoft Sentinel (KQL)
