MiniJunk persistence via schtasks.exe /create task

Ibrahim Saud@tektrix

•updated Jul 2, 2026•2•0•3

This rule detects the creation of a scheduled task via schtasks.exe using parameters often associated with malicious persistence mechanisms, such as running as SYSTEM, requiring highest privileges, or placing task actions in directories like Temp, AppData, or Public. This behavior is consistent with tactics used by various threat actors, including UNC1549/MiniJunk, to maintain persistence.