Add detection rule for PDFClick malware PDC_Update scheduled task persistence

[dlogoh]

Summary of the Pull Request

Adds a new Sigma detection rule for the creation of the suspicious scheduled task \PDC_Update that executes PDFClickUpdater.exe from %AppData%\Local\PDFClick.

This matches a known persistence technique in the PDFClick / TamperedChef family of fake PDF editor malware (trojanized PDF tools distributed via malvertising and SEO poisoning).

Reference IOC source:
https://www.truesec.com/hub/blog/reoccurring-use-of-highly-suspicious-pdf-editors-to-infiltrate-environments

Changelog

new: Suspicious PDFClick Updater Scheduled Task Creation

Example Log Event

Fixed Issues

None

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[swachchhanda000]

Hi @dlogoh,

Thanks for your PR.

Before reviewing the PR, please make sure you follow sigma-specification, which is not the case right now. I can see so many inconsistencies with this rule, which are also visible from failing pipelines. You can also get help by looking at the similar rules in the repo.

The logic you have used here is specific to some campaign, which makes it a emerging-threat rules. Please create it under rules-emerging-threats directory while making sure all the tests are passing.