TOKYOCORE Fake-Windows-Update Multi-Autostart Persistence

Duo Tech@duotech

•updated Jul 27, 2026•1•0•10

Detects the specific combination of persistence mechanisms employed by TOKYOCORE ransomware, which uses redundant Windows autostart techniques including registry run keys, boot execution commands, and startup folder file drops. The rule specifically monitors for masqueraded 'WindowsUpdate' and 'bootexec.bat' naming conventions.