CornFlake svchost32 Persistence Recreation After Removal (Non-System32 Artifact)

Duo Tech@duotech

•updated Aug 6, 2026•0•0•5

Detects recreation of svchost32/Cloud Sync Service persistence (registry Run key, Windows service, or scheduled task) within 15 minutes of removal, indicative of CornFlake backdoor re-installation following remediation.