LockAppHost disables Windows Update services post-elevation

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•2

Detects attempts to modify or disable the Windows Update service (wuauserv) using command-line utilities (sc.exe, cmd.exe, powershell.exe) in a context involving 'LockAppHost.exe'. This pattern is often associated with unauthorized attempts to tamper with security update mechanisms to prevent system patching.