Scheduled task TaskHandler created for SYSTEM persistence via schtasks (Spark RAT)

Kaung Khant Ko@kaungkhantko

•updated Aug 28, 2026•3•0•6

This rule detects the creation of a Windows scheduled task named 'TaskHandler' using the schtasks.exe utility. The task is configured to execute a specific file, 'F7u00ex.exe', on system startup under the 'NT AUTHORITY\SYSTEM' account. This behavior is indicative of a persistence mechanism, often associated with the Spark RAT malware, which attempts to maintain a foothold on the system with high-level privileges.