QUICAgent Backdoor (Windowsupdate.exe) File Transfer via Upload/Download Command

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•4

Detects network activity initiated by the QUICAgent backdoor (Windowsupdate.exe), which is utilized for file exfiltration and payload delivery. The detection is triggered by identifying the specific file name 'Windowsupdate.exe' in conjunction with the known malicious SHA-256 hash associated with this backdoor.