Gen Digital Avast ‘PrettyPrague’ Unpatched EoP PoC: Detection and Hardening Guide for Windows Endpoints

---
title: Avast Trusted Process Spawning Unexpected Command or Script Child
id: 8d3b7a10-1c4f-4a7d-9b6a-2e0c5f71aa11
status: experimental
description: Detects common Avast service or UI processes spawning command interpreters, script hosts, or proxy-execution binaries consistent with local privilege escalation or AV tamper behavior.
references:
  - https://securityaffairs.com/198243/hacking/chaotic-eclipse-releases-gendigital-avast-antivirus-zeroday-prettyprague.html
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/22
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\AvastSvc.exe'
      - '\aswEngSrv.exe'
      - '\aswidsagenta.exe'
      - '\AvastUI.exe'
      - '\AvEmUpdate.exe'
      - '\aswVmm.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\nltest.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\msiexec.exe'
      - '\schtasks.exe'
      - '\reg.exe'
  filter_known_updater:
    CommandLine|contains:
      - 'Avast\setup'
      - 'Avast Software\setup'
      - 'instup.exe'
      - 'AvEmUpdate'
  condition: selection_parent and selection_child and not filter_known_updater
falsepositives:
  - Rare vendor support diagnostics, AV repair, or managed software deployment that legitimately launches shells from Avast components
level: high
---
title: Service Control or Registry Tampering Targeting Avast Services
id: 3f0d8c42-7b6e-4d21-a5c9-9d2e4b8c0f77
status: experimental
description: Detects attempts to stop, delete, reconfigure, or change security on Avast services by common Windows service-control utilities.
references:
  - https://securityaffairs.com/198243/hacking/chaotic-eclipse-releases-gendigital-avast-antivirus-zeroday-prettyprague.html
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/05/22
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\reg.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wmic.exe'
  selection_terms:
    CommandLine|contains:
      - 'stop avast'
      - 'stop asw'
      - 'config avast'
      - 'delete avast'
      - 'sdset avast'
      - 'failure avast'
      - 'AvastSvc'
      - 'aswVmm'
      - 'aswbidsagent'
      - 'aswidsagenta'
      - 'SYSTEM\CurrentControlSet\Services\Avast'
      - 'SYSTEM\CurrentControlSet\Services\asw'
  filter_mgmt:
    CommandLine|contains:
      - ' start avast'
      - ' query avast'
      - ' qc avast'
  condition: selection_tool and selection_terms and not filter_mgmt
falsepositives:
  - Authorized service desk repair, uninstall, upgrade, or vendor support procedures
level: high
---
title: Untrusted Write to Avast Install or Data Directories
id: b61a9c55-04c7-4f84-a01e-6ca3d70c9b22
status: experimental
description: Detects file creation by non-allowlisted processes in Avast program or program-data paths where privileged components load binaries, configuration, or update artifacts.
references:
  - https://securityaffairs.com/198243/hacking/chaotic-eclipse-releases-gendigital-avast-antivirus-zeroday-prettyprague.html
  - https://attack.mitre.org/techniques/T1574/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/05/22
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1574
  - attack.t1068
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Program Files\Avast Software\'
      - '\Program Files (x86)\Avast Software\'
      - '\ProgramData\Avast Software\'
      - '\ProgramData\AVAST Software\'
      - '\Windows\System32\drivers\asw'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.sys'
      - '.bat'
      - '.cmd'
      - '.ps1'
      - '.vbs'
      - '.js'
      - '.msi'
  filter_allow:
    Image|endswith:
      - '\AvastSvc.exe'
      - '\AvEmUpdate.exe'
      - '\instup.exe'
      - '\aswEngSrv.exe'
      - '\TiWorker.exe'
      - '\TrustedInstaller.exe'
      - '\msiexec.exe'
  condition: selection_path and selection_ext and not filter_allow
falsepositives:
  - Legitimate product updates, enterprise software distribution, or vendor support tooling staging signed Avast components
level: medium

// Hunt for Avast control-plane violations and suspicious children over the last 14 days.
let lookback = 14d;
let AvastParents = dynamic(["AvastSvc.exe","aswEngSrv.exe","aswidsagenta.exe","AvastUI.exe","AvEmUpdate.exe","aswVmm.exe","instup.exe"]);
let ProxyChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","sc.exe","net.exe","net1.exe","reg.exe","whoami.exe","certutil.exe","bitsadmin.exe","msiexec.exe","schtasks.exe"]);
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| extend ParentName = tostring(split(InitiatingProcessFileName, "\")[-1]), ChildName = tostring(split(FileName, "\")[-1])
| where ParentName in~ (AvastParents)
| where ChildName in~ (ProxyChildren)
   or ProcessCommandLine has_any ("AvastSvc","aswVmm","aswbidsagent","aswidsagenta","sc stop","sc delete","sc config","sdset","SYSTEM\\CurrentControlSet\\Services\\Avast","SYSTEM\\CurrentControlSet\\Services\\asw")
| where not(ProcessCommandLine has_any ("AvEmUpdate","instup","Avast Software\\setup","Avast\\setup"))
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count(), Commands=make_set(ProcessCommandLine, 20), Accounts=make_set(AccountName, 20)
  by DeviceName, InitiatingProcessFileName, FileName, SHA256, ReportId
| order by LastSeen desc;

-- Collect Avast process context and staged executables in trusted Avast paths for triage.
LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime FROM pslist()
WHERE Exe =~ '(?i)Avast|asw'
   OR CommandLine =~ '(?i)AvastSvc|aswVmm|aswidsagenta|sc (stop|delete|config).*avast|CurrentControlSet\\\\Services\\\\(Avast|asw)'

LET files = SELECT FullPath, Size, Mtime, Ctime FROM glob(globs=['C:/Program Files/Avast Software/**/*.exe','C:/Program Files/Avast Software/**/*.dll','C:/Program Files (x86)/Avast Software/**/*.exe','C:/ProgramData/Avast Software/**/*.exe','C:/ProgramData/Avast Software/**/*.dll','C:/Windows/System32/drivers/asw*.sys'])
WHERE Mtime > now() - 1209600

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'FILE' AS Name, FullPath AS Exe, '' AS CommandLine, '' AS Username, Mtime AS CreateTime FROM files

# Verify Avast presence, capture service/security context, enable command-line auditing, and add audit SACLs without breaking product ACLs.
$ErrorActionPreference = 'Continue'
$report = Join-Path $env:ProgramData ('Avast_EoP_Exposure_' + (Get-Date -Format 'yyyyMMdd_HHmmss') + '.json')
$paths = @("$env:ProgramFiles\Avast Software", "${env:ProgramFiles(x86)}\Avast Software", "$env:ProgramData\Avast Software") | Where-Object { $_ -and (Test-Path $_) }
$svc = Get-CimInstance Win32_Service | Where-Object { $_.Name -match '^(Avast|asw)' -or $_.DisplayName -match 'Avast|AVG' } | Select-Object Name, DisplayName, State, StartMode, PathName, StartName
$bins = $paths | ForEach-Object { Get-ChildItem $_ -Recurse -Include AvastSvc.exe,aswEngSrv.exe,aswidsagenta.exe,aswVmm.sys,aswSP.sys -ErrorAction SilentlyContinue | Select-Object FullName, @{n='Version';e={$_.VersionInfo.ProductVersion}}, @{n='Signed';e={(Get-AuthenticodeSignature $_.FullName).Status}} }
$aclFindings = foreach ($p in $paths) { $a = Get-Acl $p; [pscustomobject]@{Path=$p; Owner=$a.Owner; InheritanceDisabled=$a.AreAccessRulesProtected; RiskyEntries=($a.Access | Where-Object { $_.IdentityReference -match 'Everyone|BUILTIN\Users|Authenticated Users' -and $_.AccessControlType -eq 'Allow' -and $_.FileSystemRights -match 'FullControl|Modify|Write' } | Select-Object IdentityReference,FileSystemRights,AccessControlType)} }
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable | Out-Null
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f | Out-Null
foreach ($p in $paths) {
  $acl = Get-Acl $p
  $audit = New-Object System.Security.AccessControl.FileSystemAuditRule('Everyone','Modify,Write,CreateFiles,CreateDirectories,DeleteSubdirectoriesAndFiles','ContainerInherit,ObjectInherit','None','Success,Failure')
  $acl.AddAuditRule($audit)
  Set-Acl -Path $p -AclObject $acl
}
[pscustomobject]@{Computer=$env:COMPUTERNAME; Timestamp=(Get-Date); Services=$svc; Binaries=$bins; ACLFindings=$aclFindings; Paths=$paths} | ConvertTo-Json -Depth 8 | Set-Content -Encoding UTF8 $report
Write-Output "Report written: $report. Review risky ACL entries, confirm agent is updated via vendor console, and hunt for writes/service control before applying any deny ACLs."