SharkLoader/Cobalt Strike Scheduled Task Persistence via schtasks or COM
Detects persistence mechanisms frequently associated with SharkLoader and Cobalt Strike. The rule monitors for scheduled task creation using specific suspicious naming patterns, tasks pointing to SystemSettings.exe in non-standard directories (AppData/ProgramData), high-frequency task triggers, and registry run key modifications targeting SystemSettings.exe in similar suspicious paths.
Microsoft Sentinel (KQL)
