ModeloRAT Scheduled Task Persistence

Brandon Rodriguez@BMRodriguez

•updated May 22, 2026•3•0•96

Detects the creation of a specific scheduled task (TempLogA) used by ModeloRAT to establish persistence and maintain SYSTEM-level access on compromised hosts. The rule looks for `schtasks.exe` execution with `/create`, `TempLogA`, and `SYSTEM` in the command line.