Scheduled Task Creation via Registry Modification
This rule detects the creation of scheduled tasks by monitoring specific registry key paths associated with the Windows Task Scheduler. Adversaries often use scheduled tasks for persistence, privilege escalation, or execution of malicious code. By observing modifications to these registry paths, the rule aims to identify when new scheduled tasks are being registered on a system.
Sigma
