Powershell Unregister-ScheduledTask Command in HTTP Response
This rule detects the presence of the 'Unregister-ScheduledTask' PowerShell cmdlet within the HTTP response body. This could indicate an attacker attempting to remove persistence mechanisms, specifically scheduled tasks, from a compromised system after initial compromise or during cleanup phases. The detection is case-insensitive and looks for the command along with optional parameters like '-taskname' or '-taskpath'.
Suricata
