APT37 Scheduled Task MicrosoftMusicLibrariesPackageTaskMachine Persistence

Ibrahim Saud@tektrix

•updated 18 days ago•1•0•2

Detects the creation or execution of a scheduled task named 'MicrosoftMusicLibrariesPackageTaskMachine' and the invocation of specific associated file names 'codeflush.exe' or 'settingenv.cat', which are indicators of persistence used by the threat actor APT37.