Suspicious Update Process Chain
Detects the execution of an 'update.exe' process spawned by 'svchost.exe'. This specific process chain is validated by the second-stage loader of the MiniFast backdoor (associated with Nimbus Manticore) as an anti-analysis mechanism to ensure the execution originates from its scheduled-task persistence rather than a sandbox or direct execution.
Sigma
