TOKYOCORE Fake Windows Update Service Creation (WinUpdateSvc)

Duo Tech@duotech

•updated Jul 27, 2026•6•0•7

Detects the creation of a malicious Windows service named 'WinUpdateSvc' with the display name 'Windows Update Service Helper' using sc.exe. This activity is a documented persistence mechanism for the TOKYOCORE ransomware, which executes the binary 'fsociety.exe' with SYSTEM privileges.