LausivLoader persistence via MicrosoftEdgeUpdateTaskCore scheduled task

Ibrahim Saud@tektrix

•updated Sep 20, 2026•2•0•5

This rule detects the creation or registration of scheduled tasks using common scripting engines (PowerShell, WScript, CScript) or specific task name patterns (MicrosoftEdgeUpdateTaskCore, PhotoStudio.js) often associated with malicious persistence or execution. It monitors command lines for flags such as /create, /sc onlogon, or /ru system that suggest non-standard or unauthorized task creation patterns.