PowerShell Scheduled Task 'Microsoft apdate' Running Yandex Trays.exe -tray

Subhankar H@Andrewsec57

•updated yesterday•1•0•3

Detects PowerShell registering a logon scheduled task that executes a Trays.exe binary from an AppData Yandex Trays path with the -tray argument, or a scheduled task specifically named 'Microsoft apdate'. Associated with the RareWolf AnyDesk dropper batch script.