Scheduled Task Creation via schtasks.exe /create for Persistence

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•2

Detects the creation of new scheduled tasks using the Windows schtasks.exe command-line utility. This behavior is commonly used by adversaries for persistence by ensuring malicious payloads, loaders, or backdoors are re-executed upon system events or intervals.