DragonForce locker registers one-time SYSTEM scheduled task for delayed re-execu
Detects the creation of a scheduled task using 'schtasks.exe' configured to run as the SYSTEM account for a one-time execution. This behavior is often associated with persistence mechanisms or privilege escalation attempts where an adversary seeks to execute malicious code in a high-privileged context.
Microsoft Sentinel (KQL)
