Screening Serpens - Synchronize OS Task Execution
Correlates the MiniJunk V2 persistence task with the execution of the renamed SoftwareLicencing.exe. This rule detects the creation of a scheduled task named "Synchronize OS" via schtasks.exe, and then correlates it with the execution of a file named "SoftwareLicencing.exe" on the same device. This behavior is indicative of the MiniJunk V2 malware used by the Screening Serpens APT group.
Microsoft Sentinel (KQL)
