ShadowPad persistence via EdgeCore_AutoUpdate scheduled task

Ankit Mehta@Secvyn

•updated 29 days ago•1•0•1

Detects the creation of a scheduled task containing 'EdgeCore_AutoUpdate' in the command line using either schtasks.exe or Register-ScheduledTask. This pattern is often indicative of persistence mechanisms attempting to masquerade as legitimate update services.