SilentMare persistence via scheduled task pointing to AppData updater

Ethan Andrews@eandrews

•updated Jul 28, 2026•4•0•5

Detects schtasks.exe being used to create a new scheduled task that points to an updater/downloader binary located under %APPDATA% or %LOCALAPPDATA%, consistent with SilentMare's persistence mechanism established by its installer to run the updater once per day.