Non-SYSTEM process starts CreateObjectTask scheduled task

Ibrahim Saud@tektrix

•updated 13 days ago•2•0•2

Detects a low-privileged account manually triggering the 'CreateObjectTask' scheduled task, which is a known technique to force the 'Shell Create Object Handler' (dllhost.exe) to start under the SYSTEM context. This behavior is often associated with pre-exploitation steps for privilege escalation vulnerabilities, specifically those involving OBJREF marshaling targeting specific COM objects.