Scheduled task persistence referencing MEGA executables from non-standard paths
Detects the creation of Windows Scheduled Tasks that reference MEGA sync client executables (MEGA, MEGAsync, MEGAupdater, MEGAcmd) from file paths outside of the expected Mega Limited installation directory. This can indicate an attempt to maintain persistence by masquerading as or hijacking a legitimate MEGA installation, even after the original application files are removed.
YARA-L
