ModeloRAT Scheduled Task Persistence via schtasks.exe
Detects the creation of a SYSTEM-level scheduled task using 'schtasks.exe' that launches 'pythonw.exe' with 'Pmanager.py'. This activity is indicative of the KongTuke threat actor establishing persistence for ModeloRAT, ensuring long-term access to the compromised system.
Microsoft Sentinel (KQL)
