CrysomeLoader scheduled task creation for CrySome RAT persistence
Detects the creation of a scheduled task using schtasks.exe that involves the string 'CrysomeLoader' in the command line, which is indicative of persistence or execution mechanisms associated with the CrysomeLoader malware.
Microsoft Sentinel (KQL)
