Suspicious Scheduled Task Creation via Masqueraded XML File
Detects the creation of a scheduled task using the "-XML" flag with a file that does not have the '.xml' extension. This behavior is suspicious because it attempts to masquerade the XML configuration file, potentially as a defense evasion technique during persistence establishment. Adversaries might use this to hide their scheduled tasks from casual inspection.
Sigma
