Scheduled task creation with Everyone-full-control SDDL via schtasks.exe

Emiliano Mema@Nosalva

•updated Jul 9, 2026•2•0•6

Detects the creation of a scheduled task using 'schtasks.exe' where the command line includes a specific security descriptor string '(A;;GA;;;WD)' indicating full access (GA) is granted to everyone (WD). This is a known technique used to ensure the created task has broad permissions for persistence or privilege escalation, often associated with bypassing security controls.