> ## Documentation Index
> Fetch the complete documentation index at: https://docs.socfortress.co/llms.txt
> Use this file to discover all available pages before exploring further.

# SOC Playbook: Detecting and Removing Suspicious Scheduled Tasks

> Investigate scheduled task persistence alerts and remove malicious tasks.

**Video:** [https://www.youtube.com/watch?v=5xHxhSBROEc](https://www.youtube.com/watch?v=5xHxhSBROEc)

## Goal

Identify suspicious scheduled tasks used for persistence and remove them safely.

## When to use

* Alerts indicating scheduled task creation/modification

## Prereqs

* Endpoint telemetry (Windows) + investigation pivots

## Procedure (high level)

1. Triage the alert and identify the host/user/process context
2. Enumerate scheduled tasks on the endpoint
3. Identify suspicious task(s) and associated binaries/commands
4. Contain/remediate and document

## Validation

* Suspicious task removed/disabled
* Follow-on telemetry confirms no re-creation