Sauron Loader keyroll Scheduled Task Persistence via schtasks

Ibrahim Saud@tektrix

•updated Sep 26, 2026•1•0•8

Detects the creation of a scheduled task using schtasks.exe that involves 'keyroll' in the command line. This pattern specifically flags tasks associated with the 'rnpkeys.exe' utility or tasks being created within 'keyroll' directories, which may indicate the deployment or maintenance of unauthorized key management or persistence mechanisms.