QUICAgent Backdoor Spawning Shell via Windowsupdate.exe

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•2

Detects unauthorized command-line shell execution (cmd.exe or powershell.exe) spawned by the process 'Windowsupdate.exe', or the execution of a file associated with the malicious hash attributed to the QUICAgent backdoor.