CRESCENTHARVEST - Scheduled Task via NetworkProfile Event
Detects the creation of a scheduled task using schtasks.exe that is triggered by a network connection event (Event ID 10000 from the NetworkProfile provider). This is an unusual persistence technique used by the CRESCENTHARVEST malware to ensure execution only when the machine is online.
Microsoft Sentinel (KQL)
