Remote Scheduled Task Lateral Movement via ITaskSchedulerService

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•27

Detects remote RPC calls to the ITaskSchedulerService interface, specifically focusing on operations that create or execute scheduled tasks. This behavior is commonly associated with lateral movement and persistence techniques. The rule leverages an RPC Firewall to monitor these specific RPC calls.