Slopoly Persistence Scheduled Task

Bryant Smith@flowstate

•updated Mar 15, 2026•2•0•60

Detects the creation of a scheduled task named 'Runtime Broker' that executes files from 'C:\ProgramData\Microsoft\Windows\Runtime\'. This technique is used by the Slopoly malware, deployed by the Hive0163 group, to establish persistence by masquerading as a legitimate Windows service.