HTTP Response: schtasks query Command

Tim Peck@timpeck

•updated Nov 11, 2025•0•19

This rule detects the presence of the 'schtasks /query' command within the HTTP response body. This could indicate an attacker enumerating scheduled tasks on a compromised system, potentially as part of reconnaissance or lateral movement activities. The rule specifically looks for 'schtasks' and '/query' (case-insensitive) in HTTP responses with a 200 status code.