CL-STA-1062 TinyRCT PerfWatson2.exe Scheduled Task Persistence

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule detects the creation or registration of scheduled tasks that involve the 'PerfWatson2.exe' utility or execution paths originating from within the local AppData directory. These patterns are often associated with persistence mechanisms used by malware or malicious scripts to maintain execution after reboots.