Detectionmediumexperimental
Microsoft Office Application Loading Task Scheduler DLL
Detects a Microsoft Office application loading taskschd.dll, which exposes COM interfaces for managing Windows Scheduled Tasks. This load is an early precursor to scheduled task creation or modification and has been frequently observed in macro-enabled malicious documents attempting to establish persistence.
Saksham Bhattarai, Swachchhanda Shrawan Poudel (Nextron Systems)Created 2026-11-048d1e674c-5c03-4be1-949c-4b85a472dc16windows
Log Source
WindowsImage Load (DLL)
ProductWindows← raw: windows
CategoryImage Load (DLL)← raw: image_load
Detection Logic
Detection Logic2 selectors
detection:
selection_dll:
- ImageLoaded|endswith: '\taskschd.dll'
- OriginalFileName: 'taskschd.dll'
selection_exe:
Image|endswith:
- '\eqnedt32.exe'
- '\excel.exe'
- '\fltldr.exe'
- '\graph.exe'
- '\msaccess.exe'
- '\mspub.exe'
- '\onenote.exe'
- '\onenoteim.exe'
- '\onenotem.exe'
- '\outlook.exe'
- '\powerpnt.exe'
- '\visio.exe'
- '\winproj.exe'
- '\winword.exe'
condition: all of selection_*False Positives
Legitimate add-ins or automation scripts that use Office applications to manage scheduled tasks (rare in most environments)
References
MITRE ATT&CK
Rule Metadata
Rule ID
8d1e674c-5c03-4be1-949c-4b85a472dc16
Status
experimental
Level
medium
Type
Detection
Created
2026-11-04
Path
rules/windows/image_load/image_load_office_taskschd_dll_load.yml
Raw Tags
attack.persistenceattack.privilege-escalationattack.t1053.005attack.executionattack.t1204.002