AlphaSecurity Scheduled Task Creation (Rhysida/Broomstick)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•2

Detects the creation of a scheduled task named 'AlphaSecurity' using schtasks.exe with the '/create' command-line argument. This specific task name and creation method have been associated with the Broomstick backdoor, which is used by the Rhysida ransomware group for persistence.