Remote Scheduled Task Creation with High Privileges

Jorden Smith@Jorden

•updated Feb 10, 2026•0•14

This rule detects the creation of scheduled tasks on remote systems using the 'schtasks.exe' utility. Specifically, it looks for instances where a scheduled task is created with high-privilege accounts such as 'Administrator', 'SYSTEM', or 'NT AUTHORITY'. The detection logic requires the presence of '/create', '/s' (specifying a remote system), '/tr' (task run), '/tn' (task name), and '/ru' (run as user) flags in the command line. It explicitly filters out tasks created on the local machine (localhost, 127.0.0.1, ::1). This activity is indicative of potential lateral movement or privilege escalation, as adversaries often use remote scheduled tasks to establish persistence or execute commands on other systems within a network with elevated privileges.