AgentTesla Scheduled Task Creation from AppData Temp

Thomas Carr@Tomcat

•updated Aug 14, 2025•6•0•56

This detects looks for the creation of scheduled tasks where the task content explicitly references a temporary file within the user's AppData\Local\Temp directory. This activity has been observed by AgentTesla as persistence mechanisms attempting to execute from a temporary location.