All Detections

Interlock Ransomware Execution via Scheduled Task

avatar
Elgonad .@elgonad
updated Mar 16, 20261039

Detects the creation of a scheduled task named 'TaskSystem' with SYSTEM privileges, a specific behavior of the Interlock ransomware.

Sigma