BLUERABBIT Task Persistence - OneDrive Update

nomit vyas@xoxo

•updated Jun 22, 2026•1•0•14

Detects the creation or modification of a scheduled task named 'OneDrive Update', which is known to be used by the BLUERABBIT backdoor for persistence. The rule looks for Windows Security Events (EventID 4698 for task creation, 4702 for task modification) and process execution events where command lines indicate scheduled task registration via tools like 'schtasks', 'Register-ScheduledTask', or 'New-ScheduledTask' with the specific task name 'OneDrive Update'.