SVR GraphicalProton Backdoor Scheduled Task Names

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•25

This rule detects the creation, modification, or deletion of scheduled tasks using specific task names known to be associated with the SVR-attributed GraphicalProton backdoor. The task names are designed to mimic legitimate Windows services to evade detection.