Turb00 wingo/HijackLoader scheduled task persistence via dropped binary
Detects the creation of a scheduled task where the action references an executable file located in common user-writable directories (ProgramData, AppData, Users\Public, or Temp) shortly after that file was created on the disk. This pattern is characteristic of persistence mechanisms used by threat actors associated with Operation Turb00, such as the Wingo or HijackLoader malware families, which use scheduled tasks to maintain persistence via dropped binaries.
YARA-L
