MQTTDoor/MatrixDoor malicious service creation (cplsupport/wtas)

Ankit Mehta@Secvyn

•updated 21 days ago•0•0•1

Detects the creation of Windows services using 'sc.exe' with command line arguments containing 'cplsupport' or 'wtas'. These specific strings are associated with persistence mechanisms used by the MQTTDoor and MatrixDoor backdoors.