CL-STA-1062 Scheduled Task Masquerading as MicrosoftEdgeUpdate
Detects the creation of scheduled tasks that masquerade as legitimate update processes (e.g., Microsoft Edge, Google Updater) using elevated privileges (/rl highest) and triggering on system logon (/sc onlogon). The rule specifically flags tasks associated with suspicious paths or binary names like VMWare or PerfWatson to identify potential persistence or execution mechanisms.
Splunk (SPL)
