Sauron Loader 'keyroll' Scheduled Task Persistence

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•2

Detects the creation of a Windows scheduled task where the task name contains the string 'keyroll', often associated with credential rotation or suspicious persistence mechanisms.