Scheduled task registered as SYSTEM with hex-named TaskName for persistence

Ethan Andrews@eandrews

•updated Jul 7, 2026•3•0•15

Detects the creation of a scheduled task via PowerShell using 'Register-ScheduledTask' configured to run as the SYSTEM account at system startup. The detection specifically identifies tasks with dynamically generated hexadecimal names (8-20 characters), a technique associated with the persistence mechanism of Banana RAT.