Remote Scheduled Task Creation via schtasks.exe or at.exe (T1053.005/T1021)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects the creation of scheduled tasks using schtasks.exe or at.exe by processes not signed by Microsoft. This behavior is often associated with adversary attempts to establish persistence by running code on a recurring basis or at specific times using native Windows utilities.