Scheduled Task Creation with Suspicious Command Line Arguments

Ankit Mehta@Secvyn

•updated Jun 24, 2026•1•0•5

Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.