Yuta/Glove Stealer HKCU Run Key + PyInstaller + Pastebin C2 (T1547.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects anomalous activity associated with 'winupdate.exe', including suspicious registry run key persistence, execution from abnormal directories (e.g., AppData, .cache), and unauthorized outbound network connections to Pastebin. The rule triggers when multiple signals are observed from the same host and user, indicating potential malware behavior.