Payouts King Ransomware Scheduled Task Persistence via Mozilla Task Names

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects malicious scheduled task activity attributed to the Payouts King threat actor. The rule monitors for the creation, execution, and deletion of tasks using specific naming conventions ('Mozilla\UpdateTask', 'Mozilla\ElevateTask') or patterns (e.g., /ru SYSTEM, /sc ONSTART) executed by non-standard parent processes.