Yuta/Glove Stealer WMI Subscription or Scheduled Task Persistence from Python/PyInstaller Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects potential malicious persistence mechanisms (scheduled tasks, WMI event subscriptions, or Registry Run keys) initiated by Python executables or PyInstaller-bundled processes. This behavior is associated with information stealers that use these methods to maintain presence on a compromised host.