Schedule task creation by Unsigned Process
Detects the creation of scheduled tasks using the 'schtasks.exe' utility with the '/Create' argument. This can indicate an adversary establishing persistence or scheduling malicious activity.
Microsoft Sentinel (KQL)
