TOKYOCORE fake WindowsUpdate/BootUpdate scheduled task persistence

Subhankar H@Andrewsec57

•updated Jul 27, 2026•5•0•45

Detects the creation of a scheduled task named 'WindowsUpdate' or 'BootUpdate' that triggers the execution of 'fsociety.exe' with SYSTEM privileges. This pattern is indicative of the TOKYOCORE malware establishing persistence on a Windows host.