Kimsuky NUKESPED Scheduled Task Persistence via schtasks.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects execution of schtasks.exe initiated by common scripting languages (wscript, cscript, powershell, pwsh) or execution involving files within the ProgramData directory, which are frequent indicators of malicious activity related to persistence or automated task manipulation.