Malicious GPO Scheduled Task Deployment via ScheduledTasks.xml

Bryant Smith@flowstate

•updated Apr 21, 2026•6•0•162

Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory. This behavior indicates automated task deployment via Group Policy Preferences (GPP), a technique observed in The Gentlemen RaaS and other operations to simultaneously execute ransomware or other payloads across domain-joined computers.