Suspicious Scheduled Task Creation via schtasks.exe (T1053.005)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects the creation of scheduled tasks using the 'schtasks.exe' utility with command-line arguments indicating persistence triggers ('onlogon', 'onstart') or elevation to the 'SYSTEM' account. Adversaries commonly use these methods to ensure malicious code executes automatically upon system startup or with high privileges to facilitate further exploitation.