CL-STA-1062 TinyRCT Scheduled Task Persistence via Masqueraded MicrosoftEdgeUpdate
Detects the creation of scheduled tasks using schtasks.exe that masquerade as common update tasks (Google, Microsoft) or point to suspicious file paths often associated with malware (e.g., C:\ProgramData\VMware\). The rule monitors for tasks created with high privileges or triggers, which are indicative of persistence mechanisms.
Microsoft Sentinel (KQL)
