Suspicious Elevated Scheduled Task Creation

nomit vyas@xoxo

•updated Feb 19, 2026•0•16

Detects suspicious creation of scheduled tasks via schtasks.exe using elevated accounts (Administrator, SYSTEM, NT AUTHORITY), excluding local host targets.