Suspicious Scheduled Task Creation from Temp/Downloads by SilverGorilla Dropper

Ethan Andrews@eandrews

•updated Jun 5, 2026•2•0•7

Detects the creation of scheduled tasks originating from processes executing out of temporary or download directories. This behavior aligns with the persistence mechanisms of the SilverGorilla .NET dropper, which is typically delivered via recruitment-themed phishing archives.