Silent Stealer WMI WinUpdate Persistence

Duo Tech@duotech

•updated Jun 1, 2026•2•0•16

Detects the creation of WMI Event Subscriptions containing the 'WinUpdate' string via PowerShell. This is a known persistence pattern used by Silent Stealer to masquerade its mechanisms as legitimate Windows Update tasks and survive system reboots.