Scheduled Task Persistence via WinUpdate/SoftManager/LockAppHost

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•1

This rule detects the creation of a scheduled task using 'schtasks.exe' where the task name matches commonly abused names such as 'WinUpdate.exe', 'SoftManager.exe', or 'LockAppHost.exe'. These names are frequently used by adversaries to masquerade as legitimate Windows processes to achieve persistence.