Sprysocks Startup Task Batch Script
Detects a batch or script artifact that creates a scheduled task named 'ApphostRagistreationVerifier' (a likely typo for 'ApphostRegistrationVerifier') which is configured to execute a file located within the 'Windows\Fonts\' directory. The detection specifically looks for the presence of 'schtasks' command, 'ONSTART' trigger, and 'SYSTEM' user context, indicating a persistent scheduled task.
YARA
