Gentlemen Ransomware Dual Scheduled Task Creation
Detects the creation of both 'UpdateSystem' and 'UpdateUser' scheduled tasks on the same device within a ten-minute window, a distinctive persistence pattern associated with the Gentlemen Ransomware.
Microsoft Sentinel (KQL)
