CredPhish Fake Windows Update GUI (Interlock)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•1•0•7

Detects execution of custom PowerShell phishing tools (first.ps1, main1.ps1) that present fake Windows update screens to steal local credentials. This rule specifically looks for PowerShell processes where the command line contains 'CredPhish' and either 'main1.ps1' or 'first.ps1'.