OysterLoader Persistence via Scheduled Task
This rule detects the creation of a scheduled task characteristic of OysterLoader's persistence mechanism. The malware creates a task set to run every 13 minutes, which executes a malicious DLL from the AppData\Roaming directory using rundll32.exe.
Microsoft Sentinel (KQL)
