Scheduled Task Creation with 'TPMProfiler' in Command Line
This rule detects the creation of a scheduled task with 'TPMProfiler' in its command line. This specific task name has been observed in malicious contexts related to SolarWinds Web Help Desk exploitation, typically used for persistence to run QEMU for an SSH backdoor. While legitimate TPM-related tasks exist, the 'TPMProfiler' name in this context is indicative of compromise.
Sigma
