Threat Hunt: APT35 - Subtle Snail Scheduled Task Creation

Awais Munir@iawais

•updated Oct 14, 2025•3•0•151

Detects suspicious scheduled task creation (schtasks.exe /create) linked to known Subtle Snail file hashes, malicious payload filenames, and recruitment paths. Correlates with parent processes commonly abused (browsers, explorer) and excludes benign system processes and service accounts. Aggregates events to highlight clustered activity for effective threat hunting.