Scheduled Task Persistence: Recurring Beacon on a Host

A dropper disguised as a license-activation tool runs on a financial-sector workstation and registers a Windows Scheduled Task to re-execute a PowerShell stager every 15 minutes. Each firing beacons over HTTPS to an attacker-controlled domain. Investigate the event log, XDR process tree, and proxy records to trace the persistence chain from dropper to C2.