APT36 SHEETCREEP Scheduled Task WindowsVaultSyncService Creation
This rule detects the creation of a scheduled task named 'WindowsVaultSyncService' either through the 'schtasks.exe' command-line utility or via 'ScheduledTaskCreated' device events. This specific task name, combined with a potentially misleading description, could indicate malicious activity attempting to establish persistence or execute code.
Microsoft Sentinel (KQL)
