WSPrint Persistence via Scheduled Task
This rule detects the creation of a scheduled task named "WSPrint" that executes "C:\ProgramData\WSPrint\WSPrint.exe" at system startup. This specific pattern of `schtasks.exe` usage, including the task name and program path, is associated with persistence mechanisms described in the Cisco Talos UAT-9244 report.
Microsoft Sentinel (KQL)
