Contagious Interview Persistence via Scheduled Task

Georg Lauenstein@gsec

•updated Nov 14, 2025•9•1•109

Detects the creation or modification of scheduled tasks that execute Python scripts or masquerade as legitimate system processes. This behavior is used by threat actors in the 'Contagious Interview' campaign to establish persistence.