HackTool - Default PowerSploit/Empire Scheduled Task Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•23

Detects the creation of a scheduled task using common command-line patterns associated with PowerSploit or Empire's default configurations. This rule specifically looks for `schtasks.exe` being executed by PowerShell with parameters indicative of task creation, including specific task names like 'Updater' and common scheduling triggers.