Yuta/Glove Stealer: winupdate.exe Run Key Persistence or PyInstaller Execution (T1547.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects potential persistence via Windows Registry Run keys by monitoring for the creation or modification of values pointing to suspicious paths (e.g., AppData, Temp, winupdate.exe). It also identifies suspicious execution of files originating from user-writable directories, specifically looking for indicators of PyInstaller-packaged executables or specific known malicious hashes, which are frequently used by adversaries for malware deployment.