COM Task Scheduler SYSTEM task registration after exe copy

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•1

Detects the creation or modification of Windows Scheduled Tasks involving system-level components. The rule monitors modifications to the TaskCache registry keys specifically containing 'System' or the creation of task files in the System32 directory. It excludes trusted processes like msiexec.exe and trustedinstaller.exe, which are typically responsible for legitimate system updates or installations.