Microsoft Office Application Loading Task Scheduler DLL

Saksham Bhattarai, Swachchhanda Shrawan Poudel (Nextron Systems)

Detects a Microsoft Office application loading taskschd.dll, which exposes COM interfaces for managing Windows Scheduled Tasks. This load is an early precursor to scheduled task creation or modification and has been frequently observed in macro-enabled malicious documents attempting to establish persistence.

2026-11-04 00:00:00

None

8d1e674c-5c03-4be1-949c-4b85a472dc16

attack.persistence attack.privilege-escalation attack.t1053.005 attack.execution attack.t1204.002

Community Rule

Saksham Bhattarai

Merge PR #6328 from @saksham-17 - Add Microsoft Office Application Loading Task Scheduler DLL

2026-11-04