UAT-9244 Wsprint Task SD Deletion

Tim Peck@timpeck

•updated Mar 5, 2026•1•0•44

Detects the creation of a 'WSPrint' scheduled task followed by deletion of its Security Descriptor (SD) registry value. Deleting the SD value hides the task from schtasks /query and Task Scheduler. This technique is used by UAT-9244 for stealthy persistence and is also associated with HAFNIUM/Tarrask.