Scheduled Task Created with Elevated Privilege Parameters

Jorden Smith@Jorden

•updated Feb 10, 2026•0•14

This rule detects the creation of scheduled tasks using the `schtasks.exe` utility with specific parameters indicating elevated privileges. Specifically, it looks for tasks created with the `/create` command, running under the `SYSTEM` user account (`/ru SYSTEM`), and with the highest privilege level (`/rl HIGHEST`). This combination of parameters is often leveraged by adversaries for defense evasion, persistence, and privilege escalation by ensuring the scheduled task executes with maximum system privileges.