Can your SOC see a scheduled task being created? 🕵️♂️
schtasks /create is persistence in one built-in command, and a normal user can run it without admin rights.
Safe test for a box you own: create a task that only exits, check your alerts, delete it.
Caveat: a task registered from an XML file or via the Task Scheduler API is a quieter path some rules miss.
Test and the Sigma rule here:
https://cyray.io/test-your-soc/scheduled-task-creation
#BlueTeam #DetectionEngineering #SOC #ThreatHunting #SigmaRules