Hidden scheduled task "Autoupdate" created for Python loader persistence

Emiliano Mema@Nosalva

•updated Jul 17, 2026•6•0•11

This rule monitors for the creation of a scheduled task named 'Autoupdate' that executes a python.exe script. This pattern is commonly used by attackers for persistence mechanisms to ensure their malicious Python scripts run periodically on the host. It correlates both process creation logs for schtasks.exe and security event logs (Event ID 4698) for task creation.