Scheduled Task Creation and Execution with Network Logon
This rule detects a sequence of events on a Windows machine that could indicate a scheduled task being created and executed after a network logon. Specifically, it looks for a successful network logon (EventCode 4624, Logon_Type 3) followed by the creation of a scheduled task (EventCode 4698), and then the execution of a process (powershell.exe, pwsh.exe, cmd.exe, wscript.exe, or cscript.exe) that is a child of a scheduled task host process (taskeng.exe, taskhostw.exe, taskhost.exe, or svchost.exe with 'Schedule' in its command line). All these events must occur on the same computer within a 10-minute window.
Splunk (SPL)
