Phantom Bot Task Persistence

Elgonad .@elgonad

•updated May 18, 2026•1•0•180

Detects the creation of a scheduled task named 'SystemUpdate' calling the node executable, an indicator of the 'axois-utils' phantom bot persistence. This rule specifically looks for `schtasks.exe` being used with `/create`, `SystemUpdate`, and `node` in the command line.