Starland RAT Scheduled Task Persistence via PythonLauncher Pattern
Detects the creation of Windows Scheduled Tasks that follow the 'PythonLauncher-' naming convention, often associated with Starland RAT, using PowerShell commands such as Register-ScheduledTask. The rule monitors for persistence mechanisms configured to run at logon or with highest privileges.
Cortex XDR
