Can your SOC see a scheduled task being created? 🕵️‍♂️ schtasks /create is persistence in one built-in command, and a normal user can run it without admin rights. Safe test for a box you own: create a task that only exits, check your alerts, delete it.  Caveat: a task registered from an XML file or via the Task Scheduler API is a quieter path some rules miss. Test and the Sigma rule here: https://cyray.io/test-your-soc/scheduled-task-creation #BlueTeam #DetectionEngineering #SOC #ThreatHunting #SigmaRules