Udm Mail Task Masquerade
Targets a scheduled task with trusted vendor wording whose action points to Temp, AppData, Public, or ProgramData. The UDM rule retains principal and target context for correlation.
YARA-L
Targets a scheduled task with trusted vendor wording whose action points to Temp, AppData, Public, or ProgramData. The UDM rule retains principal and target context for correlation.
Already have an account?