🎯 Scheduled task persistence

The items that name it 10

• Investigating Ephemeral Supply Chain Tampering
  writeup2026-10-15

  RadminComponentRuntime runs FamItrfc.exe --runtimechk every three hours; \NitroRuntime runs NitroPromotion.exe via PowerShell

• Malicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads
  article2026-10-08

  The \Maiden scheduled task runs every five minutes to maintain persistence

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
  writeup2026-09-28It is written here as Scheduled task persistence (T1053.005).

  Scheduled task sharing the same name as the Run key, re-created if deleted, both launching the sideloaded application.

• The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
  writeup2026-09-21

  Multiple scheduled tasks with randomized names (e.g., Nonweighise\Cancellationizing\Illuminateers) created to achieve persistence and enable further attack stages

• Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Chrome/Windows Zero-Day Chain
  writeup2026-09-09

  Scheduled tasks created for persistence: EdgeCore_AutoUpdate (UNK_LateNight ShadowPad), MicrosoftEdgeUpdatesTaskMachine and Avpcheckup (UNK_DoubleCheck), GeForceService (UNK_QuietRacket).

• UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
  writeup2026-08-20

  Creating deceptive scheduled tasks named 'Google Chrome Start' to run malware with highest privileges at logon

• When PUPs Grow Fangs: Dragon Boss Solutions' $10 Supply Chain Risk
  writeup2026-04-14

  Creates five scheduled tasks running as SYSTEM, including a boot task retained permanently, referencing WMILoad directories and ClockRemoval scripts

• A Series of Unfortunate (RMM) Events
  writeup2025-12-18

  Windows Scheduled Task created via C:\WINDOWS\system32\sc.exe to start the GoTo Resolve service for persistence

• Dissection of a PHP Backdoor leveraging php-win.exe
  writeup2025-11-16

  Boot-triggered Scheduled Task named ClockLauncher (\ClockLauncher) running as SYSTEM (S-1-5-18) with HighestAvailable run level, executing run-clock.bat

• N-IOCs to Rule Them All
  writeup2023-12-31It is written here as Scheduled Task persistence (IOC #3).

  Malware creates scheduled tasks for periodic execution; traced via Security.evtx (4698-4702) and TaskScheduler operational log (140, 141)