CreateObjectTask scheduled task invoked to spawn SYSTEM dllhost.exe

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

Detects the creation or execution of a scheduled task named 'CreateObjectTask' via schtasks or PowerShell, which is associated with spawning 'dllhost.exe' as a child process under high-privileged parent processes (svchost, taskeng, or schtasks). This behavior is indicative of potential COM hijacking or privilege escalation techniques leveraging system tasks.