DragonForce/CRPx0 Scheduled Task Persistence via schtasks or COM API

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•6

This rule detects the creation of Windows scheduled tasks using the 'schtasks.exe' utility or events generated when a task is registered. This technique is commonly used for persistence and execution by adversaries.