WSPrint Persistence via Scheduled Task Creation
This rule detects the creation of a scheduled task named 'WSPrint' that executes 'C:\ProgramData\WSPrint\WSPrint.exe' at system startup. This specific pattern is associated with the persistence mechanism described in the Cisco Talos UAT-9244 report. The rule focuses on the 'schtasks.exe' process creating a task with these specific parameters to avoid generic scheduled task alerts.
Sigma
