Office Applications Loading taskschd.dll via ImageLoad (Windows Scheduled Tasks COM)
Alerts on Office apps loading taskschd.dll, indicating potential scheduled task persistence activity.
- Product
- windows
- Category
- image_load
- Author
- Saksham Bhattarai, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-11-04
- Updated
- 2026-11-05
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags when a Microsoft Office application process loads taskschd.dll, a Windows Scheduled Tasks component exposing COM interfaces. Such DLL loads can indicate preparation for scheduled task creation or modification as part of persistence or automation. The detection relies on Windows image load telemetry that records the loaded DLL name/path and the originating Office process image.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Office Applications Loading taskschd.dll via ImageLoad (Windows Scheduled Tasks COM)
id: d970132b-45c1-475f-96ec-7f5509bf2f31
status: experimental
description: This rule flags when a Microsoft Office application process loads taskschd.dll, a Windows Scheduled Tasks component exposing COM interfaces. Such DLL loads can indicate preparation for scheduled task creation or modification as part of persistence or automation. The detection relies on Windows image load telemetry that records the loaded DLL name/path and the originating Office process image.
references:
- https://github.com/saksham-17/detection-lab/blob/cbc25dfe1e5eda0c4e5a7d66b6d3bbd27829e158/T1053.005-scheduled-task/tests/test5-task-scheduler-via-VBA/report.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_office_taskschd_dll_load.yml
author: Saksham Bhattarai, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-11-04
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1053.005
- attack.execution
- attack.t1204.002
logsource:
category: image_load
product: windows
detection:
selection_dll:
- ImageLoaded|endswith: \taskschd.dll
- OriginalFileName: taskschd.dll
selection_exe:
Image|endswith:
- \eqnedt32.exe
- \excel.exe
- \fltldr.exe
- \graph.exe
- \msaccess.exe
- \mspub.exe
- \onenote.exe
- \onenoteim.exe
- \onenotem.exe
- \outlook.exe
- \powerpnt.exe
- \visio.exe
- \winproj.exe
- \winword.exe
condition: all of selection_*
falsepositives:
- Legitimate add-ins or automation scripts that use Office applications to manage scheduled tasks (rare in most environments)
level: medium
regression_tests_path: regression_data/rules/windows/image_load/image_load_office_taskschd_dll_load/info.yml
license: DRL-1.1
related:
- id: 8d1e674c-5c03-4be1-949c-4b85a472dc16
type: derived