Windows Update Masquerading Persistence via Run Key (Lucid Stealer)

Kaung Khant Ko@kaungkhantko

•updated Jun 9, 2026•3•0•6

Detects the creation or modification of a registry run key that masquerades as 'WindowsUpdate' and points to an executable within a 'Temp' directory with a specific naming pattern (e.g., 'winupd_[a-z0-9]+.exe'). This technique is commonly used by adversaries to establish persistence on a system by ensuring their malicious payload executes upon user login.