Suspicious Modification of Service ImagePath for ClipUp Defender Evasion

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects registry modifications that set the ImagePath of a service to execute ClipUp.exe with Protected Process Light (PPL) parameters targeting Windows Defender locations. This technique is used by attackers to replace the Windows Defender service executable before it initializes, effectively bypassing security protections. The approach leverages CreateProcessAsPPL.exe to obtain PPL privileges, which normally protect security software from tampering.

2026-01-29 00:00:00

None

ae8f85a3-c3e8-4d1f-9a51-2b3fba56d1c1

attack.defense-evasion attack.privilege-escalation attack.t1562.001 attack.t1068

Nextron Sigma feed only (private)