- Engineer — Learn: Elastic documents a novel persistence pattern where the initial stealer self-deletes but leaves behind four modules (ProManager, WinUpdate, SoftManager, +1) that disable Defender and Windows Update before mining crypto; no exploitation signals, but the defense-bypass design informs endpoint hardening strategy.
- SOC/IR — Plan: Build or tune detections for the named module artifacts (ProManager, WinUpdate, SoftManager) and hunt for Windows Update / Defender service-disablement events paired with subsequent outbound crypto-mining traffic; check Elastic’s published research for YARA rules and ATT&CK mappings.
- Leader — Skip