TokenGrabber Stealer: WindowsUpdate Run Key + ONLOGON Scheduled Task Persistence

Ankit Mehta@Secvyn

•updated 10 days ago•1•0•1

Detects a dual persistence mechanism where an adversary establishes persistence both via a registry Run key and a scheduled task, both named 'WindowsUpdate'. The rule correlates these events occurring on the same device within a 15-minute window.