Suspicious update.exe Execution via svchost.exe (MiniFast Campaign Behavior)
This detection identifies suspicious execution of update.exe processes launched by svchost.exe from user-writable directories such as AppData, Temp, Downloads, and Public folders. This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence. The rule helps detect: Malicious or fake update.exe execution Abnormal parent-child process relationship (svchost.exe → update.exe) Execution from non-standard user directories Potential malware staging and execution behavior This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
Microsoft Sentinel (KQL)
