Sauron Loader 'keyroll' Scheduled Task Persistence

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•2

Detects the creation of scheduled tasks using 'schtasks.exe' where the command line arguments contain the string 'keyroll'. This pattern is often associated with automated credential management or persistence mechanisms that may be abused by adversaries.