LockAppHost disables Windows Update & Defender exclusions for mining

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•1

This rule detects the use of the LockAppHost process to execute suspicious commands associated with tampering with security configurations, including Windows Defender settings, service management (sc.exe), and task scheduling. Adversaries may abuse this process to bypass security controls, disable real-time monitoring, or maintain persistence.