Suspicious Scheduled Task Creation via schtasks.exe with Scripting Payload

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•5

Detects the creation of a scheduled task via schtasks.exe that executes a command interpreter or script engine (e.g., PowerShell, cmd, wscript) where the parent process is not signed by Microsoft. This behavior is often associated with the execution of malicious payloads, persistence mechanisms, or lateral movement.