Scheduled Task Creation via schtasks.exe Referencing LOLBin or Scripting Engine

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•2

Detects the creation of scheduled tasks using schtasks.exe where the task action executes a scripting engine or living-off-the-land binary (LOLBin). This behavior is often indicative of adversaries attempting to establish persistence or execute code using native system tools to evade detection.