Obsidian Sandstorm SilverGorilla Persistence via Schtasks from Archive or Office Parent
Detects the creation of scheduled tasks by decompression utilities or Office applications. This behavior is indicative of a dropper technique where malicious artifacts extracted from archives or spawned by Office documents establish persistence. The rule specifically monitors schtasks.exe command lines that target user-writable directories or involve rundll32-based execution, commonly used by the Obsidian Sandstorm/SilverGorilla threat actor activity.
Sigma
