Scheduled Task Mimicking OS Services
Detects schtasks.exe establishing persistence using task names that spoof legitimate Windows services. This rule specifically looks for the creation of scheduled tasks via 'schtasks.exe /create' command line that include task names such as 'Synchronize OS', 'Windows System Health', 'BackupCheck', or 'WindowsSecurityUpdate', which are commonly used by adversaries to blend in with legitimate system tasks.
Microsoft Sentinel (KQL)
