HTTP Response: schtasks /change Command Detected
This rule detects the presence of the 'schtasks /change' command within the HTTP response body. This could indicate an attacker modifying scheduled tasks on a compromised Windows system, potentially for persistence, privilege escalation, or lateral movement. The detection specifically looks for 'schtasks' and '/change' followed by '/tn' (task name) in a case-insensitive manner within HTTP responses with a 200 status code.
Suricata
