Scheduled Task Creation with Credentials via Schtasks.exe

Jorden Smith@Jorden

•updated Feb 10, 2026•0•27

This rule detects the creation of scheduled tasks using schtasks.exe where the command line explicitly includes parameters for creating a task, specifying a system, a user, and a password. This combination of parameters is often used in lateral movement or persistence techniques by adversaries.