CACTUS WinUpdCheck scheduled task launching PowerShell script from ProgramData

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•2•0•6

Detects the creation of a Windows scheduled task using schtasks.exe that executes a PowerShell script located in the C:\ProgramData\ssh directory or uses known indicators such as the 'WinUpdCheck' task name or 'winc.ps1' script reference, associated with CACTUS ransomware persistence.