BeepRAT DragonClone Schtasks Persistence via User-Writable Path Payload

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects persistence mechanisms associated with BeepRAT (a DcRAT variant) by correlating the creation of suspicious files (DLL, EXE, or C files) in user-writable directories (e.g., AppData, Temp, ProgramData) with the subsequent execution of 'schtasks.exe /create'. It specifically monitors for task creation commands referencing these suspicious paths, known loader binaries (rundll32, regsvr32, tcc.exe), or specific naming conventions like 'WindowsUpdateTempFileCleanUp'.