BeepRAT Scheduled Task Persistence via WindowsUpdateTempFileCleanUp (Operation DragonClone)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the use of the 'schtasks.exe' utility with command line arguments containing strings associated with suspicious activity or known malicious patterns, such as file cleanup or configuration manipulation, often used for persistence or stealthy execution.