Browser or Office App Spawning schtasks.exe for Scheduled Task Persistence
Detects instances where common Office applications or web browsers initiate the execution of schtasks.exe to create or modify scheduled tasks. This behavior is a common indicator of persistence mechanisms being established by malicious documents or browser-based exploits, excluding processes signed by Microsoft.
SentinelOne
