The Gentlemen RaaS: schtasks.exe /create with suspicious payload indicators

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the creation of scheduled tasks using schtasks.exe or at.exe where the command line contains suspicious indicators such as execution from AppData/Temp directories, use of LOLBins (rundll32, regsvr32, powershell), encoded commands, or suspicious command-line patterns, specifically when the initiating process is not signed by Microsoft.