Scheduled Task Created to Execute Rundll32

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•4

Detects the creation of scheduled tasks that use `schtasks.exe` to execute `rundll32.exe`. This is a common technique used by attackers for persistence and to execute malicious DLLs, often to bypass application whitelisting or other security controls.