PS1Bot/ModeloRAT Schtasks Persistence from Browser or Script Execution Chain

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•22

This rule detects the creation of suspicious scheduled tasks using either the schtasks command or through the system's scheduled task service. It focuses on task actions originating from suspicious parent processes (such as browsers or script interpreters), tasks executing scripts from writable user directories, or tasks with persistence triggers (e.g., /SC MINUTE, /SC ONLOGON) containing encoded PowerShell commands or hidden window styles indicative of malicious activity.