SilentCanvas - Uds.exe Payload Network Exfiltration

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

This rule tracks the execution of a file named 'uds.exe' and subsequently monitors for any network connections initiated by this process within a 10-minute window of its creation. This behavior is indicative of a compiled payload attempting unauthorized network exfiltration shortly after dynamic compilation, as observed in the 'Operation SilentCanvas' campaign.