Potemkin Loader Scheduled Task Persistence

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•1

Detects the creation of a scheduled task by the Potemkin Loader using the 'schtasks.exe' utility. The rule specifically looks for command lines containing task creation flags combined with an executable path located within 'AppData' directories, which is a common persistence mechanism for this loader.