Serpent Backdoor Payload Execution Via Scheduled Task
Detects post-exploitation execution technique of the Serpent backdoor. This involves creating a temporary scheduled task using an unusual method: creating a fictitious Windows event and a trigger that executes a payload once the event is created. The detection specifically looks for command-line arguments indicative of this behavior when executed by cmd.exe or powershell.exe.
Sigma
