SquadC Persistent C2 Execution via WindowsUpdateAssist Run Key

Kaung Khant Ko@kaungkhantko

•updated yesterday•3•0•6

Detects a sequence where a process persisted under the WindowsUpdateAssist Run key spawns cmd.exe to execute reconnaissance commands such as 'dir' and 'systeminfo' within a 30-minute window.