Yuta/Glove Stealer WMI Keylogger Subscription via winupdate.exe or PyInstaller Process
Detects malicious activity associated with the Yuta/Glove Stealer malware family. The rule identifies attempts to register persistent WMI event subscriptions (using wmic, powershell, or pwsh) to trigger execution or the registration of low-level keyboard hooks (WH_KEYBOARD_LL) for keylogging, originating from suspicious process paths like winupdate.exe or PyInstaller-compiled temporary directories.
YARA-L
