Hola monitor service persistence

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•5

This rule detects the persistence mechanism of the 'hola_monitor_svc' service or 'HolaMonitorService.exe' being configured for automatic start. It specifically looks for registry modifications related to this service. The XQL view includes actor and causality fields to aid in investigation.