Schtasks Creation Or Modification With SYSTEM Privileges

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•17

Detects the creation or modification of a scheduled task using 'schtasks.exe' that is configured to run with 'NT AUTHORITY\SYSTEM' privileges. This can be an indicator of privilege escalation or persistence.