All Detections

Operation XENOFISCAL - XenoUpdateManager Task Modification

avatar
Ibrahim Saud@tektrix
updated Jun 19, 2026002

Detects if schtasks is modifying an existing XenoUpdateManager task, indicating payload updating, as observed in Operation XENOFISCAL.

Microsoft Sentinel (KQL)