AN1221
Analytic 1221
Windows
Detects the creation, modification, or deletion of scheduled tasks through Task Scheduler, WMI, PowerShell, or API-based methods followed by execution from svchost.exe or taskeng.exe. Includes detection of hidden or anomalous scheduled tasks, especially those created under SYSTEM or suspicious user contexts.
WinEventLog:Security
EventCode=4698
WinEventLog:Security
EventCode=4702
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=13, 14
[TimeWindow]
Defines threshold for grouping task creation and associated execution within suspicious time proximity.
[UserContext]
Filters based on non-standard user accounts or execution under SYSTEM when not typical for the environment.
[TaskNamePattern]
Allows defenders to flag obfuscated, randomized, or suspicious task names outside normal conventions.
[CommandLineEntropyThreshold]
Flags tasks executing heavily obfuscated PowerShell or binary blobs via base64 or encoding.