OilRig APT Scheduled Task Persistence

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•29

Detects the creation of scheduled tasks with specific names ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in March 2018.