Backdoor Persistence via Scheduled Task or Run Key - Gentlemen/Mustang Panda TTPs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the creation of scheduled tasks or registry run keys that contain suspicious path indicators or specific file names often associated with persistence mechanisms. It monitors for the use of 'schtasks.exe' or 'at.exe' to create tasks referencing paths like ProgramData, Temp, AppData, or IDM\logs, as well as modifications to the 'Run' registry key with similar suspicious values.