Powershell Enable-ScheduledTask Command in HTTP Response
This rule detects the presence of the PowerShell cmdlet 'Enable-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web server to deliver or instruct a client to enable a scheduled task, potentially for persistence or privilege escalation. The detection specifically looks for 'enable-scheduledtask' case-insensitively, optionally preceded by '-taskname' or '-taskpath', within a successful HTTP 200 OK response.
Suricata
