TOKYOCORE fsociety.exe Persistence via Fake Windows Update Scheduled Task
Detects the creation of a suspicious scheduled task via schtasks.exe that masquerades as Windows Update or BootUpdate. The task is configured to execute 'fsociety.exe' with SYSTEM privileges upon system startup, logon, or boot, a behavior consistent with TOKYOCORE ransomware persistence and lateral movement.
Cortex XDR
