Scheduled task creation referencing sideloaded ToddyCat loader binaries

Duo Tech@duotech

•updated Jul 6, 2026•2•0•6

Detects the creation of scheduled tasks using schtasks.exe where the command line includes indicators associated with potential malicious binaries or tools. Monitoring for these specific filenames in task creation can identify persistence mechanisms or authorized task scheduling abuse.