schtasks create Command in HTTP Body Response

Tim Peck@timpeck

•updated Nov 11, 2025•0•19

This rule detects the presence of the 'schtasks /create' command within the HTTP response body. This could indicate an adversary attempting to schedule tasks on a compromised system by delivering the command via an HTTP response, potentially for persistence or execution.