Scheduled task created to launch NetSupport client32.exe at logon

Ankit Mehta@Secvyn

•updated Sep 9, 2026•1•0•3

Detects the creation of a scheduled task using schtasks.exe or reg.exe that is configured to run at system logon (/sc onlogon) using potentially malicious or persistence-related filenames such as client32.exe or NSM789508.