Suspicious Update Process Chain (MiniFast)

Ethan Andrews@eandrews

•updated May 26, 2026•14•0•385

Detects the execution of 'update.exe' where the parent process is 'svchost.exe'. This specific process chain is indicative of the MiniFast malware, which uses this technique as an anti-analysis check. Legitimate software updates or scheduled tasks might also use svchost.exe to spawn update.exe, requiring careful tuning to reduce false positives.