Scheduled Task Creation via schtasks.exe /create

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects the creation of a new scheduled task using the Windows native schtasks.exe command-line utility. This behavior is commonly associated with persistence mechanisms or lateral movement activities where attackers schedule tasks to execute malicious payloads.