TOKYOCORE Registry Run Key Persistence as 'WindowsUpdate'

Subhankar H@Andrewsec57

•updated Jul 27, 2026•1•0•5

Detects the creation or modification of Windows Registry Run keys that masquerade as the legitimate 'WindowsUpdate' process. The rule identifies suspicious autorun entries, such as 'fsociety.exe' or specific file hashes, being registered under common Run or RunOnce keys to maintain persistence.