Persistence via schtasks.exe scheduled task creation using task.xml
Detects schtasks.exe /create execution referencing task.xml or pointing to a script interpreter (wscript.exe/cscript.exe), indicating malware persistence via scheduled task
YARA-L
Detects schtasks.exe /create execution referencing task.xml or pointing to a script interpreter (wscript.exe/cscript.exe), indicating malware persistence via scheduled task
Already have an account?