Mustang Panda SHARDLOADER/MINIRECON Scheduled Task Persistence in ProgramData/IDM

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the creation of scheduled tasks using schtasks.exe where the task involves paths often associated with user-writable directories (ProgramData, AppData, Temp) and specific suspicious keywords. This behavior is common for adversaries seeking persistence by scheduling execution of potentially malicious payloads located in non-standard or user-writable locations.