DragonForce COM Task Scheduler one-shot task with SYSTEM principal
Detects the creation of a scheduled task using the schtasks utility where the execution principal is set to SYSTEM. This pattern is commonly observed in malware such as DragonForce ransomware to establish persistence or execute payloads with elevated privileges.
YARA-L
