Lunar Spider Lsassa Backdoor Persistence
Detects the creation of a scheduled task by a process named 'lsassa.exe', a .NET backdoor used by Lunar Spider. The malware masquerades as the legitimate 'lsass.exe' process and establishes persistence by creating a task that runs on startup.
YARA-L
