Scheduled Task Creation via schtasks.exe Following mshta/PowerShell Chain

Arnold Chan@slaz

•updated Sep 5, 2026•1•0•1

Detects the creation of a scheduled task using 'schtasks.exe' where the initiating process is a script interpreter such as 'mshta.exe' or 'powershell.exe'. This behavior is often associated with the execution of malicious payloads or the establishment of persistence.