Suspicious CorelDefrag Scheduled Task Executing PowerShell
Detects creation of a scheduled task named Microsoft\Windows\Defrag\CorelDefrag configured to execute an obfuscated PowerShell payload on a daily basis. This task mimics a legitimate Windows Defrag task to maintain persistence.
Sigma
