STAC4713 QEMU TPMProfiler Scheduled Task Persistence under SYSTEM

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•4

Detects malicious persistence mechanisms using the Windows Task Scheduler, specifically targeting the creation or execution of 'TPMProfiler' or 'qemu-system-x86_64.exe' under high-privilege accounts (SYSTEM). This rule monitors for schtasks.exe task creation, anomalous parent-child process relationships involving task host processes, and unauthorized module loads of taskschd.dll associated with QEMU activity.