Mustang Panda Persistence via Sched Task or Run Key from Sideloaded DLL Host
Detects the creation of scheduled tasks by known Mustang Panda DLL sideloading hosts, specifically Solid PDF Creator or Citrix Receiver components. This rule identifies persistence mechanisms likely established during the post-compromise phase of espionage operations.
Sigma
