Argamal RAT Scheduled Task Persistence with Encoded PowerShell via schtasks.exe

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the creation of scheduled tasks using schtasks.exe with suspicious command-line patterns, specifically those containing encoded commands or specific strings related to Windows system components (WindowsColorSystem, Calibration). This technique is often used by adversaries to establish persistence or facilitate execution of malicious payloads.