Larva-24009 scheduled task persistence via spoofed Intel/Google Update names
Detects the creation of scheduled tasks using names specifically identified in the Larva-24009 (HeptaX) campaign. These task names spoof legitimate Intel and Google Update tasks to establish persistence for a PowerShell-based backdoor, allowing the attacker to evade detection by mimicking common software update processes.
Microsoft Sentinel (KQL)
