Scheduled Task Persistence via schtasks.exe or Event 4698 (LausivLoader)

Ibrahim Saud@tektrix

•updated Sep 20, 2026•1•0•6

Detects the creation of scheduled tasks using schtasks.exe or Event ID 4698, specifically filtering for tasks that execute PowerShell, WScript, or JavaScript files. This behavior is indicative of potential persistence mechanisms, such as those observed in the LausivLoader.