RedCurl Scheduled Task Persistence via PCALUA

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•13

Detects creation of scheduled tasks followed by execution of pcalua.exe on the same endpoint. This combination was observed by Huntress during RedCurl intrusions and is uncommon in legitimate enterprise activity.