CL-STA-1062 TinyRCT MicrosoftEdgeUpdate Scheduled Task Persistence

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•6

Detects the creation of a Windows scheduled task that attempts to execute a VMware-related binary (vmwared.exe) under the guise of 'MicrosoftEdgeUpdate' on system logon with the highest privileges. This behavior is indicative of a persistence mechanism attempt.