Scheduled task persistence for codeflush.exe/settingenv.cat backdoor
Detects the creation of scheduled tasks using schtasks.exe that are configured to run every minute, specifically targeting command lines associated with known suspicious processes like 'codeflush.exe' or potentially masqueraded music library tasks.
Microsoft Sentinel (KQL)
