← All detection heuristics · Script
critical
WINDOWS_SCHEDULED_TASK_SCRIPT_EXEC
What it means
Scheduled Task XML launches a script interpreter or LOLBin.
Why it fires
The file is a Windows Scheduled Task definition whose Exec action starts a script host or LOLBin such as wscript, cscript, PowerShell, mshta, cmd, rundll32, or regsvr32. This is a persistence/execution artifact, especially when arguments point into user-writable locations such as Users\Public, ProgramData, AppData, or Temp.
Other Script heuristics
SCRIPT_WSH_OBFUSCATED WINDOWS_PS_ADDTYPE_WINAPI_TAMPER LNK_POWERSHELL_BIGINT_NETWORK_ENDPOINT WINDOWS_PS_SCREENSHOT_UPLOAD_EXFIL WINDOWS_SCRIPT_CERTUTIL_RUNDLL_CHAIN SCRIPT_WSH_STREAM_WRITE_RUN_CHAIN WINDOWS_SCRIPT_BASE64_BINARY_DROPPER LNK_SCRIPT_DOWNLOADER MACOS_ZSH_LOADER SCRIPT_HEAVY_STRING_DECODER_OBFUSCATION SCRIPT_WSH_MASQUERADE LNK_HIDDEN_SCRIPT_EXEC