Suspicious Scheduled Task Creation via XML in AppData/Local (JustAskJacky Persistence Pattern)

Morgan Nwaiku@sir_morganzee

•updated May 26, 2026•7•0•221

Detects suspicious scheduled task creation using schtasks.exe with XML task imports from user-writable directories such as AppData\Local. This behavior is associated with malware families like JustAskJacky, which establish persistence by creating GUID-named scheduled tasks that execute malicious payloads such as node.exe and obfuscated JavaScript files.