Remote Scheduled Task Runs a Staged Batch as SYSTEM
Detects schtasks creating a one-time task on another host using supplied credentials and a batch file under Windows Temp, executed as SYSTEM. This behavior is indicative of an adversary establishing persistence or lateral movement by scheduling malicious code to run with high privileges on a remote system.
Cortex XDR
