Persistence via QEMU Scheduled Task

Elgonad .@elgonad

•updated Feb 12, 2026•1•0•29

Detects the creation of a scheduled task named "TPMProfiler" that executes QEMU ('qemu-system-x86_64.exe'). This technique was observed being used by threat actors to establish persistence after exploiting SolarWinds Web Help Desk vulnerabilities.