Delayed Execution via Scheduled Task for Sandbox Bypass

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects HTTP traffic where the URI contains both 'schtasks' and '/delay' (case-insensitive). This combination suggests an attempt to create a scheduled task with a delayed execution, which can be used by adversaries for sandbox evasion or persistence.