Yuta/Glove Stealer WMI Keylogger Subscription via winupdate.exe or PyInstaller Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects Yuta/Glove Stealer malware attempting to establish persistent WMI event subscriptions for keylogging. This is identified by the execution of wmic.exe or PowerShell to register event filters, consumers, or bindings, initiated by suspicious parent processes such as winupdate.exe or processes originating from temporary/staging directories.