Deceptive Microsoft Update Service Registration
Detects deceptive registration using the exact string 'Microsoft Update Service' mapped to non-Microsoft binaries in non-standard paths. This could indicate an adversary attempting to masquerade malicious activity as legitimate system services.
Microsoft Sentinel (KQL)
