Scheduled Task Creation Executing from Startup Folder

Jorden Smith@Jorden

•updated Feb 20, 2026•0•22

Detects scheduled task creation where the task action executes files from Windows Startup folders. This layered persistence combines scheduled tasks (flexible triggers, potential privilege escalation) with startup folder execution for redundancy and resilience.