StrikeShark Scheduled Task Persistence via User-Writable Path or OneDrive Name Spoof

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects the creation or modification of scheduled tasks that either utilize user-writable directories (e.g., AppData, Temp) for task execution or mimic the naming convention of 'OneDrive Standalone Update' tasks. This behavior is indicative of persistence mechanisms used by the StrikeShark campaign to deploy SharkLoader and related payloads, such as Cobalt Strike.