AsyncRAT CheckRealtekAudioVersion Persistence

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•6

Detects scheduled tasks named "CheckRealtekAudioVersion" or "RealtekAudioEnhancements64" created for AsyncRAT persistence. This rule specifically looks for the execution of 'schtasks.exe' with the '/create' argument and the presence of these specific task names in the command line, which are known indicators of AsyncRAT establishing persistence.