SparroWocky Persistence via ProcAuditManager Service Creation

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•2

Detects the creation or execution of a Windows service named 'ProcAuditManager', which is utilized by the SparroWocky backdoor for persistence. The malware masquerades as a legitimate system audit service to evade detection.