Suspicious 'Recovery Diagnostics' Scheduled Task Creation

Bryant Smith@flowstate

•updated Mar 21, 2026•2•0•47

Detects the creation of a scheduled task named "Recovery Diagnostics" that executes PowerShell scripts from the C:\Users\Public directory. This specific technique has been observed being used by threat actors as a persistence and execution mechanism during INC ransomware staging to trigger base64-encoded PowerShell payloads for data exfiltration.