Screening Serpens - SVCHOST Parent Evasion Verification
Identifies instances where update.exe enforces an svchost.exe parent to evade sandboxes, specifically looking for 'UpdateChecker.dll' being loaded by a process named 'update.exe' whose parent is 'svchost.exe'. This behavior is associated with the Screening Serpens APT group.
Microsoft Sentinel (KQL)
