Kimsuky schtasks persistence masquerading as Google Chrome Update

Arnold Chan@slaz

•updated 21 days ago•0•0•0

This rule detects the creation of a scheduled task via schtasks.exe that uses a name similar to 'Google Chrome Update' but is initiated by a process other than the legitimate Google Update executable or from an unexpected folder location. This behavior is commonly used by adversaries to establish persistence while masquerading as legitimate software update mechanisms.