Scheduled Task Created with with Explicit Credentials
This rule detects the creation of scheduled tasks using `schtasks.exe` where the task is configured to run with elevated privileges (Administrator, SYSTEM, or NT AUTHORITY) and is intended for remote execution (indicated by the `/s` switch) but explicitly excludes local host targets. This pattern is often indicative of lateral movement or persistence mechanisms where an attacker establishes a scheduled task on a remote system to execute malicious code with high privileges.
Splunk (SPL)
