Scheduled Task Creation and Deletion by Same User
This rule detects the creation and subsequent deletion of scheduled tasks on a Windows system within a one-hour window. It specifically looks for Sysmon EventCode 1 (process creation) where the image is 'schtasks.exe' and the command line contains both '/create' and '/delete' operations, along with '/S' (system name) and '/TN' (task name) parameters. It excludes operations targeting 'localhost', '127.0.0.1', or '::1'. The rule then counts the number of create and delete actions per computer and user within an hour, triggering an alert if both create and delete actions are observed.
Splunk (SPL)
