Suspicious ClipUp Execution with Windows Defender Path

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious execution of ClipUp.exe with parameters that may indicate an attempt to write to Windows Defender protected locations. ClipUp.exe may be used to overwrite the service executable of Windows Defender, potentially allowing an attacker to disable or manipulate Windows Defender.

2026-01-29 00:00:00

None

35be9b70-5f4e-4e2a-8f3c-7bdae30c7c4f

attack.defense-evasion attack.persistence attack.t1218 attack.t1562.001

Nextron Sigma feed only (private)