XWorm - Service Masquerading Staging (T1036.005)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Correlates the dropping of the decrypted XWorm payload into %LOCALAPPDATA% with a name mimicking a Windows Kernel service.