Malicious Driver Masquerading as Legitimate Service 'wsftprm'

Duo Tech@duotech

•updated Jul 9, 2026•1•0•2

Detects the creation of a Windows service named 'wsftprm'. This specific service name is often associated with malicious activities, particularly in historical cases involving persistent threats or unauthorized software installation.