Scheduled task persistence launching masqueraded defender.exe/Sang.exe outside legitimate install paths as SYSTEM
Detects scheduled-task persistence launching masqueraded defender.exe/Sang.exe with SYSTEM privileges at startup, outside legitimate Windows Defender/Sangfor install paths.
Microsoft Sentinel (KQL)
