T1489: Silver Fox Disables Windows Update Services and Renames Update DLLs
Detects unauthorized attempts to disable or stop critical Windows Update services (wuauserv, UsoSvc, uhssvc, WaaSMedicSvc) via command line tools or service configuration changes. This behavior is indicative of defense evasion by malware such as Silver Fox/Gh0st RAT, aimed at preventing security updates or disabling security-related service monitoring.
Microsoft Sentinel (KQL)
