HoneyMyte - Fake Windows Defender ATP Scheduled Task

Georg Lauenstein@gsec

•updated 10 days ago•0•0•0

Detects creation of a scheduled task named "Windows Defender Advanced Threat Protection Service" configured to run at system startup with SYSTEM privileges and launch an executable named defender.exe. HoneyMyte (Mustang Panda) used this exact schtasks command to establish boot persistence for the CoolClient backdoor sideloader, masquerading the task and binary as a legitimate Windows Defender component.