ScarCruft Scheduled Task Persistence
Detects the creation of specific scheduled tasks known to be used by ScarCruft (APT37) to establish persistence for NarwhalRAT. The rule looks for scheduled task creation events (EventID 4698 in SecurityEvent logs or ActionType 'ScheduledTaskCreated' in DeviceEvents) where the task name matches known malicious task names used by ScarCruft, specifically 'MicrosoftUserInterfacePicturesUpdateTackMachine' and 'MicrosoftMusicLibrariesPackageTaskMachine'.
Microsoft Sentinel (KQL)
