TELEPUZ CipherAllocator Service Registration for Persistence

Duo Tech@duotech

•updated Jul 20, 2026•2•0•4

Detects evidence of the TELEPUZ malware establishing persistence by installing a Windows service named 'CipherAllocator' or 'PilotmasterMast'. The rule monitors for the installation of these specific services via Windows Event ID 7045, process command line execution, and direct registry key modifications.