Payouts King Mozilla Scheduled Task Creation via cmd.exe Pipe (ONSTART/SYSTEM)

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•5

Detects the creation, execution, or deletion of Windows scheduled tasks using 'Mozilla' task names (specifically '\Mozilla\UpdateTask' or '\Mozilla\ElevateTask'). The rule identifies tasks created with SYSTEM privileges and 'ONSTART' triggers via schtasks.exe, as well as associated administrative commands to run or delete these tasks, and correlates these with Security Event ID 4698.