Lateral Movement via Scheduled Task with Network Logon
This rule detects lateral movement via scheduled tasks by correlating three distinct events within a 10-minute window on the same computer and for the same user. First, it identifies a successful network logon (EventID 4624, LogonType 3), excluding machine accounts and anonymous logons. Second, it looks for the creation of a scheduled task (EventID 4698). Third, it detects the execution of suspicious processes (PowerShell, cmd, wscript, cscript) where the parent process is either svchost.exe (with 'Schedule' in its command line) or taskeng.exe/taskhostw.exe/taskhost.exe, indicating execution by the Task Scheduler. This sequence suggests an attacker authenticating remotely, creating a scheduled task, and then immediately executing it.
Sigma
