TinyRCT Scheduled Task Masquerading as MicrosoftEdgeUpdate or GoogleUpdater

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects the creation of scheduled tasks using schtasks.exe that run at logon with highest privileges, specifically targeting known update or system binaries which may indicate malicious persistence or masquerading techniques.