Scheduled Task Running as SYSTEM with Suspicious Command Lines

Jorden Smith@Jorden

•updated Jan 8, 2026•4•0•57

Detects scheduled tasks configured to run as SYSTEM executing suspicious binaries or commands, often used for privilege escalation and defense evasion.