Process Tree Break via Scheduled Task Spawn
Detects use of scheduled tasks to break process trees and hide parent relationships
Microsoft Sentinel (KQL)

Detects use of scheduled tasks to break process trees and hide parent relationships

Already have an account?