Scheduled Task Creation for Persistence via Startup Folder
This rule detects the creation of scheduled tasks that are configured to execute programs from common Windows startup folders. It specifically looks for the use of 'schtasks.exe' with the '/create' and '/tr' (task run) arguments, or PowerShell commands 'Register-ScheduledTask' with '-Action' arguments. The rule then filters these activities to identify instances where the command line specifies paths within 'Start Menu\Programs\Startup' or '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup', which are common locations for persistence.
Splunk (SPL)
