CTRL Toolkit - Disguised Registry Payloads and Scheduled Task

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•9•0•148

Detects the CTRL persistence pattern by correlating suspicious registry value modifications (using disguised names like 'ShellStateVersion1', 'IconSizeVersion1', 'IconUnderlineVersion1') with the creation of scheduled tasks via PowerShell or schtasks.exe. The scheduled tasks often involve hidden or encoded commands and are set to launch at startup or with specific system privileges.