Most Popular Detection 2026: Scheduled Task Persistence via schtasks and COM Abuse (T1053.005)
Detects the creation of scheduled tasks using the 'schtasks.exe' utility that point to suspicious script execution, encoded commands, or files located in commonly abused writable directories like Temp or ProgramData. This behavior is indicative of potential persistence mechanisms.
Sigma
