Suspicious GlobalProtectVPNUpdate Scheduled Task Execution

Kaung Khant Ko@kaungkhantko

•updated Sep 8, 2026•0•0•2

This rule detects the creation of a scheduled task named 'GlobalProtectVPNUpdate' using schtasks.exe, which has been identified as a technique used to facilitate the execution of malicious payloads masquerading as legitimate GlobalProtect VPN components. It also monitors for the subsequent execution of 'GlobalProtect.exe' when initiated by Windows background services like taskeng.exe or svchost.exe, which is indicative of persistence and unauthorized code execution.