Kimsuky MemLoad Scheduled Task Persistence

Brandon Rodriguez@BMRodriguez

•updated May 21, 2026•1•0•131

Detects the creation of scheduled tasks named 'ChromeCheck' or 'EdgeCheck' that execute regsvr32.exe. This behavior is associated with Kimsuky's MemLoad loader, which establishes persistence to deploy the httpTroy backdoor.