Scheduled Task 'keyroll' Created for Sauron Loader Persistence

Ibrahim Saud@tektrix

•updated 10 days ago•1•0•1

Detects the creation of a scheduled task named 'keyroll' using either schtasks.exe command line arguments or Windows Event ID 4698. This specific task name is associated with the persistence mechanism of the Sauron Loader, particularly when it references 'rnpkeys.exe' or 'ProgramData\keyroll'.