CL-STA-1062 TinyRCT Scheduled Task Masquerading as MicrosoftEdgeUpdate
Detects the creation of scheduled tasks using the schtasks utility that masquerade as legitimate update services (MicrosoftEdgeUpdate or GoogleUpdaterTaskSystem). These tasks are configured to run at logon with highest privileges, specifically aiming to persist the TinyRCT backdoor (associated with files such as vmwared.exe or vmtools.exe) in ProgramData directories.
YARA-L
