Matanbuchus 3.0 Scheduled Task Creation

Collin Lairamore@Bollinmore

•updated May 8, 2026•5•0•212

This rule detects the creation of a scheduled task named 'Update Tracker Task' using either 'schtasks.exe' or PowerShell cmdlets ('Register-ScheduledTask', 'New-ScheduledTask'). This specific task name has been associated with the Matanbuchus 3.0 loader.