Suspicious schtasks /create Persistence for MiniJunk Backdoor

Ibrahim Saud@tektrix

•updated Jul 2, 2026•3•0•12

Detects the creation of suspicious scheduled tasks using the 'schtasks.exe' utility. The rule flags tasks that are created from suspicious paths (e.g., Temp, ProgramData), tasks executing common script extensions (vbs, ps1, bat, hta, js), or tasks that masquerade as legitimate Windows or System update tasks.