Suspicious Winlogon Notify Key Logon Persistence (via registry_set)

This rule detects threat actors may misuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.