SnappyClient scheduled-task persistence correlated with HijackLoader/Vidar activity (Operation Turb00)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•2•0•4

This rule detects the creation of a scheduled task, either via schtasks.exe or Event ID 4698, where the task content points to a suspicious, user-writable directory (e.g., Temp, AppData). It correlates this activity with the presence of known Loader/Stealer process indicators (HijackLoader/Vidar) occurring within a 15-minute window on the same host, indicating likely persistence establishment by malicious software.