ChainScript AtLogon scheduled task persistence with Run-key fallback

Ibrahim Saud@tektrix

•updated 14 days ago•0•0•3

Detects the persistence sequence associated with 'ChainScript', which involves creating a hidden scheduled task using PowerShell or specific scripts, and a fallback mechanism that creates a registry run key entry if the task creation fails. The rule monitors for PowerShell commands, bridge script execution, and registry modifications involving the 'ComponentTask33Agent' or wscript.exe executing an '_agent.vbs' file.