Repeated Security Patch Activity

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects an unusual number of process creations (Event ID 4688) containing both 'security' and 'patch' in their command line within a one-hour window on a single computer. This could indicate automated patching activity, but a high volume might also suggest suspicious system modifications or an attempt to disguise malicious activity as legitimate patching.