Yuta/Glove Stealer: WPF Dropper Staging winupdate.exe with Pastebin/Discord C2
Detects the execution of potential malware disguised as 'winupdate.exe' and specific network traffic associated with it. The rule identifies suspicious file paths (e.g., in AppData cache) and execution by the binary while communicating with external domains such as pastebin.com or discord.com, which are often abused for command-and-control or payload delivery.
CQL
