CountLoader GUID-suffixed GoogleUpdateService/MSEdgeUpdateService task abuse with anomalous payload
Detects anomalous scheduled task execution by identifying processes named 'csvchost.exe' or 'psvchost.exe' that reference GoogleUpdateService or MSEdgeUpdateService task names containing GUID patterns. It further correlates this with suspicious command-line indicators such as 'App.py' references, 'WakeToRun' flags, '-headless' flags, or PowerShell bypass techniques, which are associated with the delivery of CountLoader and DeviceManager RATs in DOUBLECUP campaigns.
Cortex XDR
