Screening Serpens - WindowsSecurityUpdate Task Creation

Ibrahim Saud@tektrix

•updated Jun 19, 2026•1•1•5

Detects the creation of a specific scheduled task named 'WindowsSecurityUpdate' using 'schtasks.exe' in conjunction with network communication to 'azurewebsites.net'. This activity is indicative of the MiniUpdate malware, associated with the Iranian APT group 'Screening Serpens', attempting to establish persistent access.