Suspicious Schtasks Schedule Type With High Privileges

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects the creation or modification of scheduled tasks using 'schtasks.exe' that are configured to run with high privileges (NT AUTHORITY\SYSTEM, SYSTEM, or HIGHEST) and utilize suspicious schedule types such as ONLOGON, ONSTART, ONCE, or ONIDLE. This combination is often indicative of persistence or privilege escalation attempts by adversaries.