scheduled task creation

Description

Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_creation.yml Questions via Twitter: @janvonkirchheim.

Query · kql

DeviceEvents 
| where ActionType == "ScheduledTaskCreated"
  and InitiatingProcessAccountSid != "S-1-5-18"
Raw source scheduled task creation · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 34208765-264e-4abe-805b-f645925fbadb
name: scheduled task creation
description: |
  Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_creation.yml
  Questions via Twitter: @janvonkirchheim.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  DeviceEvents 
  | where ActionType == "ScheduledTaskCreated"
    and InitiatingProcessAccountSid != "S-1-5-18"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.