Suspicious Scheduled Task Creation from Public Documents

Luís Marques@remotecodeexecution

•updated today•0•0•1

Detects the creation of a scheduled task utilizing an XML configuration file located in the C:\Users\Public\Documents directory. The CryptoBandits worm component creates these tasks to maintain persistence for both itself and the stealer payload.