Scheduled task masquerading as 'Google Chrome Update'

Ibrahim Saud@tektrix

•updated 22 days ago•1•0•5

Detects the creation of a scheduled task containing the string 'Google Chrome Update' in the command line, where the task is not the legitimate 'GoogleUpdateTaskMachine' task. The rule specifically targets tasks that execute PowerShell or arbitrary executables, which is a common persistence technique used by adversaries to mask malicious tasks as legitimate software updates.