APT36 scheduled task masquerading as update service for persistence

Ibrahim Saud@tektrix

•updated Sep 20, 2026•1•0•3

Detects the creation of scheduled tasks using either 'schtasks.exe' or 'powershell.exe' (Register-ScheduledTask) where the task name or configuration references common update or startup task patterns, or contains indicators of potential process hiding or encoded command execution.