Suspicious Scheduled Task Creation via schtasks.exe for Persistence

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

Detects the creation of scheduled tasks using schtasks.exe that point to high-risk directories (Temp, AppData, ProgramData) or utilize obfuscated PowerShell commands (encoded parameters). This behavior is often associated with adversary persistence or initial execution.