Microsoft Office Application Loading Task Scheduler DLL

Title: Microsoft Office Application Loading Task Scheduler DLL
Status: experimental
Description:Detects a Microsoft Office application loading taskschd.dll, which exposes COM interfaces for managing Windows Scheduled Tasks. This load is an early precursor to scheduled task creation or modification and has been frequently observed in macro-enabled malicious documents attempting to establish persistence.
References:
  -https://github.com/saksham-17/detection-lab/blob/cbc25dfe1e5eda0c4e5a7d66b6d3bbd27829e158/T1053.005-scheduled-task/tests/test5-task-scheduler-via-VBA/report.md
Author: Saksham Bhattarai, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-11-04
modified:None
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1053.005'
• -'attack.execution'
• -'attack.t1204.002'

Logsource:

• category: image_load
• product: windows

Detection:
  selection_dll:
ImageLoaded|endswith:'\taskschd.dll' OriginalFileName:'taskschd.dll'   selection_exe:
    Image|endswith:
      -'\eqnedt32.exe'
      -'\excel.exe'
      -'\fltldr.exe'
      -'\graph.exe'
      -'\msaccess.exe'
      -'\mspub.exe'
      -'\onenote.exe'
      -'\onenoteim.exe'
      -'\onenotem.exe'
      -'\outlook.exe'
      -'\powerpnt.exe'
      -'\visio.exe'
      -'\winproj.exe'
      -'\winword.exe'

  condition:all of selection_*
Falsepositives:
  -Legitimate add-ins or automation scripts that use Office applications to manage scheduled tasks (rare in most environments)
Level: medium