Remote Scheduled Task Deletion After Creation
Detects the deletion of scheduled tasks on remote systems shortly after their creation, indicating potential cleanup of lateral movement artifacts. This behavior is often observed when attackers create tasks for execution and then remove them to evade detection. The correlation groups events by user, meaning it can match operations performed by the same account across different target systems. This rule specifically looks for `schtasks.exe` being used with the `/create` and `/delete` commands targeting remote systems (excluding localhost, 127.0.0.1, and ::1) within a one-hour window.
Sigma
