Persistence via 'IBM SPSS WinWrap Basic IDE' / WinWrapIDE.exe (CNCMachineRMS/BabaDeda)
Detects potential persistence mechanisms involving 'IBM SPSS WinWrap Basic IDE' or 'WinWrapIDE.exe'. The rule monitors for the creation of a scheduled task, registry run key additions, or event ID 4698 (scheduled task creation) associated with these artifacts. It further correlates these activities with suspicious account creation events (Event IDs 4720, 4732) on the same device within a one-hour window.
Microsoft Sentinel (KQL)
