Gryxa layered persistence: WinRTCS tasks, own_lib.ps1 and WMI subscription

ills3c Intel&Coffee@Ills3C

•updated 4 days ago•0•0•2

Detects the creation of a Windows scheduled task with the name or command containing 'WinRTCS' correlated with WMI permanent event subscription activities or execution of the 'own_lib.ps1' watchdog script within a 1-hour window on the same device, using Microsoft Defender XDR tables.