InstallFix Relaunches after Reboot through Task Repair Logic

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•1•0•7

Detects a persistence script querying for a missing task or payload and recreating it when absent, indicating self-repair behaviour. This rule specifically looks for command-line activity involving 'powershell', 'cmd', or 'schtasks.exe' that queries for scheduled tasks and then attempts to create or register them, often using keywords like 'if', 'missing', 'not found', 'create', or 'Register-ScheduledTask'.