Scheduled Task OneDriveUpdateScheduler Persistence via explorer.exe

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•4

This rule detects potential persistence mechanisms by monitoring for the creation of scheduled tasks using the 'OneDriveUpdateScheduler' name, as well as the execution of suspicious scripts named 'update1.vbs' or 'update1.ps1' by wscript.exe, cscript.exe, or powershell.exe when spawned from explorer.exe.