Hidden Scheduled Task Creation with Scripting Language

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•2

This rule detects the creation of scheduled tasks (Event ID 4698) that are configured to execute scripting languages (PowerShell, cmd, Python, Java) with hidden window styles. This behavior is often indicative of an adversary attempting to establish persistence while evading detection by hiding the execution of their malicious scripts.