ValleyRAT Persistence via 'Batteries' Scheduled Task

Ethan Andrews@eandrews

•updated Feb 23, 2026•3•0•34

Detects the creation or execution of a scheduled task named 'Batteries' pointing to the AppData Roaming directory, which is a specific persistence mechanism for the ValleyRAT campaign. This rule identifies the creation of the scheduled task via 'schtasks.exe', the creation of the legacy '.job' file for the task, or the execution of the payload 'WavesSvc64.exe' from its persistence location.