Scheduled Task Spoofing of Microsoft Services
Detects the creation of scheduled tasks using 'schtasks.exe' with names that mimic legitimate Microsoft services such as 'RealtekAudio', 'CoreUIComponents', 'OneDriveHealthTask', or 'WindowsUpdate'. This technique is often used by adversaries for persistence.
Microsoft Sentinel (KQL)
