APT36 Scheduled Task Masquerading as OneDrive Updater (RUSTYMOVE)

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•4

Detects the creation of scheduled tasks using schtasks.exe or PowerShell that reference OneDriveUpdater or specific AccountPictures/Automata paths, which are often used by adversaries to establish persistence or run malicious code.