• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Fake PDF Converter Persistence Task

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Elgonad .@elgonad
    •updated Jan 23, 2026•5•3•130

    Detects the creation of scheduled tasks used for persistence by fake PDF converter malware. These tasks are created in the registry under the TaskCache tree.

    Sigma

    Tags

    TA0003 - PersistenceT1053.005 - Scheduled TaskTA0002 - ExecutionTA0004 - Privilege EscalationRegistry Key ModificationRegistry Value SetScheduled Task CreatedWindowsattack.persistenceattack.t1053.005

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?