Casbaneiro Fake 'Superfetch Core Endpoint' Progress Dialog Lure

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

This rule detects the execution of common command-line utilities (cmd.exe, mshta.exe, AutoIt3.exe) using command-line arguments that mimic legitimate service names or security analysis tools (e.g., 'Microsoft Update Superfetch Core Endpoint Service'). This behavior is indicative of an adversary attempting to mask malicious activity by using strings that resemble benign system services or localized security scanner output, likely for obfuscation or evasion.