CoolClient media_updaten service persistence via Sang.exe
Detects installation of the 'media_updaten' Windows service configured to run Sang.exe with the 'work' argument, used by CoolClient for persistence.
Microsoft Sentinel (KQL)
Detects installation of the 'media_updaten' Windows service configured to run Sang.exe with the 'work' argument, used by CoolClient for persistence.
Already have an account?