Miku Campaign: SYSTEM scheduled task 'Shell'/'Tunnel' persistence for hidden bind-shell/tunnel

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•2

This rule detects suspicious activity involving the creation of scheduled tasks for persistence using command-line arguments indicative of tool execution (e.g., chisel, powershell) or the direct execution of hidden PowerShell scripts intended to bypass execution policy.