Scheduled Task Persistence via schtasks.exe /create or /change

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects the creation or modification of scheduled tasks using the schtasks.exe utility initiated by a process not signed by Microsoft. This behavior is often associated with adversary attempts to establish persistence or automate malicious code execution.