APT36 Scheduled Task Persistence Masquerading as Software Updater

Ibrahim Saud@tektrix

•updated 20 days ago•0•0•1

Detects the creation of scheduled tasks using schtasks.exe or PowerShell that masquerade as legitimate Microsoft Edge or OneDrive update tasks. This behavior is associated with APT36 (Transparent Tribe) and their use of modular malware to establish persistence.