Operation Turb00: Dual Persistence via Startup .lnk and Legacy .job in C:\Windows\Tasks (No schtasks.exe)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•2•0•3

Detects the creation of files within the Windows startup directory or Windows tasks folder. The rule specifically excludes known system binaries like schtasks.exe and mstask.exe to reduce noise, and attempts to categorize the artifacts based on specific naming patterns.