This case study documents an advanced persistence technique involving a scheduled task launching base64-encoded PowerShell, used to execute malicious commands without dropping traditional malware to disk.

This case study focused on a low-profile intrusion attempt involving a standalone executable (patcher.exe) found in a writable but non-standard directory (C:\ProgramData\WinUpdate).

In this second case study of the structured IOC triage series, we examined a subtle but dangerous host-based compromise involving the abuse of the Windows utility `rundll32.exe` to execute a malicious DLL payload.