Amadey Scheduled Task Persistence via Suspicious .job File or schtasks.exe
Detects persistence attempts by the Amadey infostealer. The rule monitors for unauthorized creation of .job files directly in the Windows Tasks directory or the execution of schtasks.exe from suspicious locations such as TEMP or APPDATA folders.
Sigma
