Trojanized HTS Update Chain Installs HTSPnew.Exe Ransomware

Ibrahim Saud@tektrix

•updated Sep 20, 2026•1•0•4

Detects the execution of files related to 'UBPPatch' or 'HTSPnew', specifically looking for PowerShell scripts (.psh) or executables (.exe) that match these potentially non-standard or obfuscated update/patch filenames. The rule also looks for command lines referencing 'Update.Lst', often associated with custom or unauthorized patch mechanisms.