Scheduled Task Persistence via schtasks.exe to Temp/AppData or Remote Host

Ibrahim Saud@tektrix

•updated 15 days ago•2•0•1

Detects the creation of scheduled tasks using schtasks.exe that either trigger on user logon or startup and point to common writable directories (e.g., Temp, AppData), or tasks created with a remote system argument, which is frequently used by adversaries for persistence or lateral movement.