ET HUNTING schtasks end Command in HTTP Body Response
This rule detects the string "schtasks" followed by "/end" and then "/tn" within the HTTP response body. This pattern indicates that a client is receiving a response that contains a command to end a scheduled task using the `schtasks` utility. This could be part of a command-and-control communication or a lateral movement attempt where an adversary is managing scheduled tasks on a compromised system.
Suricata
