Sigma Rules

Microsoft Office Application Loading Task Scheduler DLL

Detects a Microsoft Office application loading taskschd.dll, which exposes COM interfaces for managing Windows Scheduled Tasks. This load is an early precursor to scheduled task creation or modification and has been frequently observed in macro-enabled malicious documents attempting to establish persistence.