APT28 - Scheduled Task Creation via XML Redirection
Detects the dynamic creation of a scheduled task where cmd.exe first writes an XML task definition file to disk, which is then immediately used by schtasks.exe to create the task. This is a characteristic behavior of the APT28 "Operation MacroMaze" campaign.
Microsoft Sentinel (KQL)
