Armorsteal SysCheck scheduled tasks launching SysMon.py from SystemHealth\Update

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•2

Detects the creation of scheduled tasks using schtasks.exe or PowerShell that execute SysMon.py from the non-standard C:\Windows\SystemHealth\Update\ directory, or the corresponding scheduled task creation events.