DeviceManager MicroUpdaterV1 scheduled task creation with pythonw.exe execution
Detects DeviceManager creating a scheduled task named MicroUpdaterV1 via schtasks.exe /Create /F from a %TEMP%\t.xml definition, followed by pythonw.exe execution, consistent with DeviceManager's persistence mechanism that re-runs every 10 minutes.
Microsoft Sentinel (KQL)
