Malicious MSI masquerading as Windows Update (Updates Verify / LexSoft Ltd.)

Emiliano Mema@Nosalva

•updated Aug 20, 2026•8•0•10

This rule monitors for the execution of msiexec.exe with command-line arguments involving 'update_ms.msi' specifically referencing 'Updates Verify' or 'LexSoft Ltd.', which may indicate the installation of potentially unauthorized or malicious software masquerading as legitimate updates.