kkRAT Persistence via Scheduled Task to Terminate AV/EDR

Kaung Khant Ko@kaungkhantko

•updated Sep 20, 2025•3•5•106

Detects the creation of a scheduled task designed to run with SYSTEM privileges and terminate common AV/EDR processes. This technique is used by kkRAT for persistence and defense evasion.