All Detections

ModeloRAT Scheduled Task Persistence

avatar
Ibrahim Saud@tektrix
updated Jun 17, 2026003

Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python payload, indicative of ModeloRAT persistence.

Microsoft Sentinel (KQL)