ATT&CK T1053 - Remote Scheduled Task Creation via SMB

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects the creation of remote scheduled tasks over SMB by looking for the string "schtasks" in TCP traffic destined for port 445 (SMB). This activity is often associated with persistence techniques where attackers establish scheduled tasks on remote systems.