Scheduled Task cmd /c move Relocates Payload into Timestamp AppData Folder

Luís Marques@remotecodeexecution

•updated Jul 24, 2026•3•0•2

Detects cmd.exe invoked with '/c move' relocating a downloaded payload into a timestamp-named appdata folder, consistent with a Lampion scheduled-task move stage.