ET HUNTING Powershell Register-ScheduledTask command in HTTP Body Response
This rule detects the presence of the PowerShell cmdlet 'Register-ScheduledTask' within an HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating a scheduled task, potentially delivered via a web-based command and control channel or a malicious download.
Suricata
