CRPx0 Scheduled Task Creation via schtasks /create

Ibrahim Saud@tektrix

•updated 25 days ago•0•0•0

Detects the creation of scheduled tasks using the 'schtasks.exe' utility, a technique often used by the CRPx0 ransomware to establish persistence on a system. The rule specifically monitors for the '/create' command-line argument while excluding common, benign updater processes such as those from Microsoft Edge, Google, and OneDrive.