Scheduled Task Masquerading As Adobeonedrive With System Privileges

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•3

Detects the creation of a scheduled task using 'schtasks' with 'SYSTEM' privileges, masquerading as Adobe or OneDrive, and pointing to an executable in a user-writable path (Temp, AppData, ProgramData, or Users\Public). This pattern is often used by adversaries for persistence or privilege escalation.