Scheduled Task Creation via Temp XML
Detects the creation of scheduled tasks using an XML file located in a temporary directory, a technique used by DesckVB for stealthy persistence.
Microsoft Sentinel (KQL)

Detects the creation of scheduled tasks using an XML file located in a temporary directory, a technique used by DesckVB for stealthy persistence.

Already have an account?