XWorm Persistence via Scheduled Task, Run Key or Startup Folder

Kaung Khant Ko@kaungkhantko

•updated Sep 12, 2025•6•0•191

This rule detects XWorm persistence mechanisms. It looks for the creation of scheduled tasks, registry run keys, or startup folder shortcuts that execute suspicious payloads from the AppData\Roaming directory. The malware is known to use filenames like "WmiPrvSE.exe" (masquerading as a legitimate system file) and "Soundman.exe").