Payouts King Mozilla Scheduled Task Creation via SYSTEM Privilege

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the creation of scheduled tasks using specific Mozilla-related naming patterns ('\Mozilla\UpdateTask' or '\Mozilla\ElevateTask') that execute with SYSTEM privileges, a behavior associated with Payouts King ransomware persistence mechanisms.