Scheduled Task Created to Execute Windows Sandbox
Detects scheduled task creation configured to execute WindowsSandbox.exe, often used to evade EDR by running malware in an isolated container.
Sigma
Detects scheduled task creation configured to execute WindowsSandbox.exe, often used to evade EDR by running malware in an isolated container.
Already have an account?