Phantom Bot Scheduled Task Persistence

Ethan Andrews@eandrews

•updated May 27, 2026•2•0•86

Detects the creation of a scheduled task named 'SystemUpdate' using 'schtasks.exe', which is a persistence mechanism observed in the Phantom Bot malware distributed via malicious npm packages. The rule specifically looks for the 'create' action and the 'SystemUpdate' task name in the command line.