Armorsteal scheduled tasks launching Python kit from C:\Windows\SystemHealth\Update

ills3c Intel&Coffee@Ills3C

•updated 3 days ago•2•0•5

Detects Armorsteal persistence mechanism using scheduled tasks (SysCheck2/SysCheckX/SysHeal) to execute a bundled Python kit located in C:\Windows\SystemHealth\Update. It covers task creation via schtasks.exe and execution of script contents via the Task Scheduler service spawning interpreters or conhost.