Remote Task Creation via ATSVC Named Pipe
Detects the creation of remote scheduled tasks by monitoring access to the 'atsvc' named pipe over SMB. This activity is indicative of using tools like 'at.exe' or direct API calls to schedule tasks on a remote system, which can be leveraged for privilege escalation, execution, lateral movement, or persistence.
Sigma
