Detects when a Microsoft Office application loads the Windows Task Scheduler DLL (taskschd.dll) via image load events. The rule flags both a module load of taskschd.dll (ImageLoaded|endswith or OriginalFileName == taskschd.dll) and the presence of an Office executable (e.g., excel.exe, winword.exe, etc.) loading in the same event sequence. This combination indicates an early step for using COM interfaces exposed by taskschd.dll to manage Scheduled Tasks, a common persistence technique in macro-enabled documents. The detection aims to identify macro-driven attempts to establish persistence through Task Scheduler manipulation before task creation or modification occurs.