APT37 NarwhalRAT Scheduled Task Creation
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern. The rule looks for 'schtasks.exe' being executed with '/create' or '-create' flags and the unique task name 'MicrosoftUserInterfacePicturesUpdateTackMachine'. It covers process creation events from DeviceProcessEvents, SecurityEvent (EventID 4688), and Sysmon (EventID 1).
Microsoft Sentinel (KQL)
