Scheduled Task Creation via schtasks.exe or Task Scheduler COM Abuse (UNC1549)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•2

Detects the creation of scheduled tasks using schtasks.exe by processes that are not digitally signed by Microsoft Corporation, as well as the loading of taskschd.dll by non-standard/unsigned processes. This behavior is indicative of potential persistence mechanisms or unauthorized task scheduling activity.