PowerShell Get-AccessibleScheduledTask enumeration for COM host abuse

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects the execution of PowerShell commands that leverage specific tooling for scheduled task enumeration, commonly used for discovery or persistence management. The rule flags usage of 'Get-AccessibleScheduledTask' in conjunction with flags associated with tools like NtObjectManager or OleViewDotNet.