Uncommon One-Time Scheduled Task at 00:00 with Suspicious Command
Detects the creation of scheduled tasks using `schtasks.exe` that are configured to run once at exactly 00:00 and execute suspicious commands or scripts. The suspicious commands include common scripting engines (wscript, cscript, powershell), WMI, regsvr32, or executables located in the AppData directory. This pattern is often used by adversaries for persistence or execution at a specific, often stealthy, time.
Sigma
