BQTLock Ransomware Scheduled Task Persistence via schtasks.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects BQTLock ransomware (BaqiyatLock) establishing persistence by creating scheduled tasks via schtasks.exe. The detection monitors for scheduled task creation commands initiated by the ransomware payload (BQT.exe) or its loader (start.exe), specifically targeting tasks that execute files from high-risk paths like AppData or Temp, or directly reference BQT.exe.