Remote Scheduled Task Creation via RPC

Lacey Cochrane@NullVectorX

•updated Sep 25, 2026•0•0•3

This rule detects the creation of scheduled tasks on a remote host via the Task Scheduler RPC interface (opnum 1, RegisterTask). This interface is commonly abused by lateral movement tools such as Impacket's atexec, SharpTask, and SynkLoader to execute code or establish persistence on a remote system.