StrikeShark SharkLoader Scheduled Task Persistence via schtasks /create
Detects the creation of scheduled tasks using schtasks.exe that exhibit indicators associated with StrikeShark SharkLoader or Cobalt Strike persistence. Indicators include task actions that reference rundll32 with a DLL, execution from user-writable directories (AppData, ProgramData, Temp), the use of base64-encoded command lines, or specific task names mimicking OneDrive updates.
YARA-L
