Payouts King Ransomware Scheduled Task Masquerading as Mozilla Update

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation of a scheduled task masquerading as a legitimate Mozilla maintenance task (UpdateTask or ElevateTask). The rule specifically flags when such tasks are configured to run as SYSTEM, triggered on system start, and are created via a command line executed by a parent process of cmd.exe, which is indicative of Payouts King ransomware persistence activity.