CL-STA-1062 Scheduled Task Masquerading as MicrosoftEdgeUpdate
Detects the creation of scheduled tasks using names associated with Microsoft Edge or Google update processes to achieve persistence. The rule specifically targets the deployment of known payloads like TinyRCT (vmwared.exe) or PerfWatson.exe at logon with highest privileges, masquerading as legitimate update tasks.
Microsoft Sentinel (KQL)
