KongTuke Malware - Scheduled Task SoftwareProtection
The rule detects the execution of 'run.exe' where its image path contains 'SoftwareProtectionPlatform' and its command line arguments include both 'SoftwareProtectionPlatform' and 'udp.pyw'. This specific combination is indicative of the KongTuke malware establishing persistence through a scheduled task named 'SoftwareProtection'.
Sigma
