Remote Scheduled Task Creation via schtasks.exe (T1053.005)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the creation of a scheduled task using the schtasks.exe utility with persistence-related triggers such as system startup or user logon. The rule excludes common trusted processes that frequently interact with the Task Scheduler to minimize false positives.