Zoom Scheduled Task Hijacking (Nimbus Manticore)
This rule detects attempts to modify the Zoom update scheduled task using `schtasks.exe /change`. This activity is indicative of potential scheduled task hijacking, as legitimate Zoom updaters typically do not use this command to modify their own tasks. The detection specifically looks for command lines containing both `/change` and `ZoomUpdateTaskUser-`.
Microsoft Sentinel (KQL)
