Scheduled Task Persistence via schtasks.exe with Suspicious Payload

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•1

Detects the creation of Windows scheduled tasks that include suspicious interpreters (PowerShell, cmd.exe, rundll32) or execution paths located in common attacker-writable directories (Temp, AppData, ProgramData), which is a common technique for persistence and command-and-control re-establishment.