BeepRAT Persistence via WindowsUpdateTempFileCleanUp Scheduled Task
This rule monitors for the creation of scheduled tasks using the Windows 'schtasks.exe' utility that contain command-line strings associated with BeepRAT malware activity. Specifically, it identifies task names or configurations used for persistence or payload execution, such as 'WindowsUpdateTempFileCleanUp', 'TCC\\config.ini.c', 'HFY.exe', and various TCC loader arguments.
Splunk (SPL)
