DeepLoad ClickFix Reboot Survival Task

Ibrahim Saud@tektrix

•updated Jun 18, 2026•3•0•14

This rule detects the creation of a scheduled task using 'schtasks.exe' that includes a PowerShell command with 'invoke-expression' (iex) and 'invoke-restmethod' (irm) to ensure persistence across reboots. This behavior is characteristic of the DeepLoad malware, often delivered via ClickFix campaigns.