Scheduled Task Names Used By SVR For GraphicalProton Backdoor
This rule detects the creation, modification, or deletion of scheduled tasks with specific names known to be used by the SVR-affiliated GraphicalProton backdoor. The rule monitors Windows Security Event IDs 4698 (A scheduled task was created), 4699 (A scheduled task was deleted), and 4702 (A scheduled task was updated) for a predefined list of suspicious task names.
Sigma
