Bitter APT ftp.exe icon.ico download chain leading to schtasks creation
Detects a multi-stage execution pattern associated with the Bitter APT group, where ftp.exe is first used to download resource files (icon.ico or res.ico), followed closely within 15 minutes by the creation of a scheduled task utilizing PowerShell/cmd or command execution referencing those resource files.
Microsoft Sentinel (KQL)
