Masqueraded SoftwareProtection Scheduled Task for CrashFix RAT
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python script. This technique is used by the CrashFix variant to establish persistence for its Python-based RAT, mimicking a legitimate Windows service to blend in. The malware drops its components into a subfolder of AppData to masquerade as a legitimate platform component.
Microsoft Sentinel (KQL)
