Malware Persistence via Scheduled Task Creation

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•1

This rule detects the creation of scheduled tasks using `schtasks.exe` or `at.exe` with specific command-line arguments (`/create`, `/tn`, and either `/ru` or `/tr`). It then correlates these process events with registry events related to Task Scheduler keys or values containing "Task" to identify potential persistence mechanisms.