Scheduled Task Creation with Suspicious Command Line

Information hacker@Informationhacker

•updated Jan 26, 2026•26•1•165

Detects the creation of scheduled tasks using 'schtasks /create' that include suspicious command-line arguments often associated with malicious activity, such as PowerShell execution, web requests (Invoke-WebRequest, curl, wget, bitsadmin), or script execution (.ps1, .vbs, .js). This rule aims to identify persistence mechanisms or initial access attempts.