Unsigned UpdateAssistant/SysMaintenance process running alongside AV/EDR process

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects malicious processes associated with the HVNC backdoor (e.g., UpdateAssistant.exe, SysMaintenance.exe) concurrently running alongside identified security product processes on the same device. This behavior suggests the malware is performing automated reconnaissance of installed security software to inform further compromise actions.