TaskHandler service created to relaunch F7u00ex.exe persistentl (Spark RAT)
This rule detects the use of the Windows Service Control Manager (sc.exe) to create or configure a service named 'TaskHandler'. The rule specifically looks for command lines that reference potentially malicious files like 'F7u00ex.exe' or specific driver/restart patterns often associated with the persistence mechanism of the Spark RAT.
Microsoft Sentinel (KQL)
