C2Agent parent-spoof scheduled task c2a_<n> create/delete and fork2 relaunch

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•3

Detects potential C2Agent parent-spoofing behavior characterized by short-lived scheduled tasks (created and deleted within a 10-minute window with names matching c2a_<n>) or process relaunches carrying specific -fork2 command-line markers.