Payouts King: Scheduled Task Creation for Persistence via schtasks.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the creation of scheduled tasks using schtasks.exe with suspicious command line parameters or originating from unusual parent processes. This includes tasks created to run as SYSTEM, tasks configured with ONSTART triggers, tasks referencing common temporary directories, or tasks created by processes typically unrelated to scheduled task management (e.g., Teams, remote assistance tools, or command processors).