DeviceManager CIS-locale check followed by task and install directory deletion
Correlates a GetUserDefaultUILanguage locale check with subsequent deletion of a known-malicious scheduled task (MicroUpdaterV1, GoogleUpdateService, or MSEdgeUpdateService) and its install directory within a 5-minute window, consistent with DeviceManager's CIS-locale sandbox/analyst evasion self-cleanup routine.
Microsoft Sentinel (KQL)
