Powershell Set-ScheduledTask Command in HTTP Response Body
This rule detects the presence of the PowerShell cmdlet 'Set-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web-based mechanism to deliver or execute commands related to scheduled task creation or modification on a compromised system, potentially for persistence.
Suricata
