HumanitarianBait Scheduled Task Creation

Ethan Andrews@eandrews

•updated May 7, 2026•13•0•445

Detects the creation of a scheduled task named 'WindowsHelper', which is used by Operation HumanitarianBait for persistence to launch its Python implant every 5 minutes. This rule specifically looks for command-line executions of 'schtasks.exe' or commands containing 'schtasks' that include '/create' and the task name 'WindowsHelper'.