Potemkin Loader Scheduled Task Persistence

nomit vyas@xoxo

•updated Jun 25, 2026•1•0•4

Detects the creation of a Windows Scheduled Task with command line arguments indicative of the Potemkin Loader, which uses task scheduling to maintain persistence by executing an RMM payload located in the AppData directory upon system startup or user logon.