TernDoor Persistence via Hidden Scheduled Task

Brandon Rodriguez@BMRodriguez

•updated Mar 20, 2026•10•0•94

Detects the creation of the 'WSPrint' scheduled task followed by specific registry modifications intended to hide the task from the Task Scheduler UI. This is a known persistence technique used by the UAT-9244 actor for its TernDoor backdoor.