DRAYN AUOptions Registry Write Disabling Windows Automatic Updates

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects modifications to Windows Update registry keys (AUOptions or NoAutoUpdate) by non-Microsoft signed processes. Adversaries may use this to disable automatic security updates, preventing the installation of critical patches to maintain a persistent, vulnerable environment.