Renamed Jusched.EXE Execution

Title: Renamed Jusched.EXE Execution
Status: test
Description:Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group
References:
  -https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf
Author: Markus Neis, Swisscom
Date: 2019-06-04
modified:2023-02-03
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1036.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Description:
      -'Java Update Scheduler'
      -'Java(TM) Update Scheduler'

  filter:
    Image|endswith: '\jusched.exe'
  condition:selection and not filter
Falsepositives:
  -Unknown
Level: high