Suspicious Scheduled Task Creation Involving Temp Folder
Detects the creation of scheduled tasks using 'schtasks.exe' that are configured to run only once and involve a temporary folder in their command line. This behavior can be indicative of an adversary establishing temporary persistence or execution mechanisms, often seen in post-exploitation activities.
Sigma
