All Detections

CloudZ RAT Scheduled Task Persistence

avatar
Bryant Smith@flowstate
updated May 5, 20260114

Detects the creation of the specific scheduled task 'SystemWindowsApis' or scheduled tasks querying for the malicious payload paths (e.g., 'windosDoc'), utilized for persistence by the CloudZ loader.

Sigma