---
title: Tip: check every Windows host for Defender exclusions and hidden repeating tasks that point into C:\ProgramData. Stadia and many stealers use both | ctxsec
url: https://ctxsec.com/items/tip-audit-defender-exclusions-hidden-tasks-programdata
description: ""
status: "guidance based on Varonis Stadia analysis (Oct 22)"
published: 2026-10-24
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-audit-defender-exclusions-hidden-tasks-programdata.md)

guidance based on Varonis Stadia analysis (Oct 22)

2026-10-24

### Tip: check every Windows host for Defender exclusions and hidden repeating tasks that point into C:\ProgramData. Stadia and many stealers use both

Two quick checks catch a lot of commodity malware, including the new Stadia RAT:

- **Defender exclusions:** `Get-MpPreference | Select -Expand ExclusionPath` (run as admin). Investigate any path under `C:\ProgramData\` or a user profile that you didn't add. In bulk, Defender for Endpoint and Intune can report exclusions, or watch for PowerShell `Add-MpPreference` in script-block logs (4104).
- **Hidden repeating tasks:** enable 'Audit Other Object Access Events' so Security events 4698 and 4702 are logged, then alert on task XML containing `<Hidden>true</Hidden>` and a short repetition interval that runs from ProgramData. Locally: `Get-ScheduledTask | ? {$_.Settings.Hidden}`.
- Don't key detections only on `schtasks.exe`. Stadia registers its task through COM.

Sources: [Varonis Threat Labs: StealC Is Back, and This Time It's a RAT](https://www.varonis.com/blog/stealc-returns)