BeepRAT Persistence via WindowsUpdateTempFileCleanUp Scheduled Task
Detects the creation of a scheduled task named 'WindowsUpdateTempFileCleanUp' or suspicious scheduled task naming conventions associated with the BeepRAT malware. The rule specifically monitors for the execution of a TCC loader chain, often masquerading or leveraging configurations located within the %LOCALAPPDATA%\TCC directory to maintain persistence with high privileges.
Microsoft Sentinel (KQL)
