Hidden Scheduled Task Creation via Schedule.Service COM Object Masquerading as Microsoft Corporation

Duo Tech@duotech

•updated Jul 20, 2026•3•0•8

Detects the creation of a hidden scheduled task using the Schedule.Service COM object, where the author field is explicitly set to 'Microsoft Corporation' to masquerade as a legitimate system task.