Scheduled Task Created to Execute Rundll32

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•5

Detects the creation of scheduled tasks that use `schtasks.exe` to execute `rundll32.exe`. This is a common technique used by attackers for persistence and to execute malicious DLLs, often to bypass application whitelisting or other security controls.