schtasks creating onlogon highest-privilege task launching AppData binary

ills3c Intel&Coffee@Ills3C

•updated yesterday•4•0•3

Detects the creation of a scheduled task using schtasks.exe that triggers on logon at the highest privilege level and executes a binary from the AppData directory, or uses the specific DeviceSync task name, while filtering out known benign software updaters and installers.