Malicious Scheduled Task Creation

Kaung Khant Ko@kaungkhantko

•updated Jul 14, 2025•6•5•133

Detects the creation of scheduled tasks (event ID 4698) where the task content includes references to potentially suspicious file paths and execution of known Living-off-the-Land Binaries and Scripts (LOLBAS). These behaviors are commonly associated with persistence mechanisms used by threat actors or malware.