Slopoly Backdoor Persistence via schtasks.exe

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the creation of a scheduled task using 'schtasks.exe' with specific command-line arguments that indicate an attempt to establish persistence. The rule looks for 'schtasks.exe' creating a task named 'Runtime Broker' that executes a program from a suspicious path within 'C:\ProgramData\Microsoft\Windows\Runtime\'. This pattern is often used by adversaries to maintain access to a system.