Dropping Elephant GoogleErrorReport Scheduled Task Persistence

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

This rule detects the creation or configuration of a scheduled task named 'GoogleErrorReport' which references 'Fondue.exe' located in the 'C:\Users\Public' directory. This specific pattern is associated with 'Dropping Elephant' malware persistence, where the task ensures the binary executes persistently on the host.