Remote Scheduled Task Information Discovery via RPC Firewall

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•21

This rule detects remote RPC calls specifically targeting the Task Scheduler service (SASec) to read information about scheduled tasks. This activity is often associated with reconnaissance by adversaries attempting to understand the environment's scheduled jobs.