LockAppHost tampers with Windows Update/Defender for mining

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

This rule detects instances where LockAppHost.exe or a variation of it (likely used as a proxy) initiates processes or command-line arguments that interact with Windows services, scheduled tasks, or Windows Defender configurations. This behavior is indicative of an adversary attempting to disable security features, suppress Windows updates, or manipulate system services to evade detection.