Kimsuky Scheduled Task Persistence via Renamed NirCmd (taskhostw.exe)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects the creation of a scheduled task named 'OneDrive KeepAlive' or a task set to execute every 5 minutes, in conjunction with the execution of 'taskhostw.exe' containing 'exec hide' in its command line. This pattern is indicative of the Kimsuky threat group using a renamed version of the NirCmd utility to maintain persistence and execute commands silently.