OysterLoader Scheduled Task Creation and Rundll32 Execution
This rule detects the creation of scheduled tasks and the execution of rundll32.exe, both associated with the OysterLoader malware. Specifically, it looks for scheduled tasks created with specific command-line arguments including '/Create', '/SC MINUTE', '/MO 13', and known OysterLoader task names ('COPYING3', 'VisualUpdater', 'AlphaSecurity', 'DetectorSpywareSecurity'), which then execute 'rundll32' with 'DllRegisterServer'. Additionally, it identifies 'rundll32.exe' executing DLLs from the 'AppData\Roaming' directory with 'DllRegisterServer' and the same known OysterLoader names.
Microsoft Sentinel (KQL)
