TTF Trap Campaign - Marker-Gated JScript Dropper Persistence via Scheduled Task in Public\Libraries
Detects scheduled task creation used for persistence by the TTF Trap phishing campaign. The obfuscated JScript dropper checks for the absence of next-stage files and a marker variable (e.g. 'YESSSSSSSS') before copying itself to %PUBLIC%\Libraries and spawning cmd.exe to run schtasks with a recurring minute-based interval referencing the dropped loader files in that folder. Broadened beyond the exact 'schtasks /create /sc minute /mo 15' pattern to also catch scheduled task creation referencing %PUBLIC%\Libraries with other minute intervals, and direct wscript.exe/cscript.exe execution of files staged under %PUBLIC%\Libraries as part of the marker-gated persistence check.
Cortex XDR
