Renamed Jusched.EXE Execution
Detects the execution of a process where the original description is 'Java Update Scheduler' or 'Java(TM) Update Scheduler', but the executable file name is not 'jusched.exe'. This behavior is indicative of an adversary renaming a legitimate utility to evade detection, a technique known to be used by groups like Cobalt Group.
Sigma
