Scheduled Task Creation by AI Coding Agent Process (T1053 Persistence)
Detects the creation of scheduled tasks (via schtasks.exe or at.exe) directly by known AI agent developer binaries (e.g., claude, cursor, aider) or indirectly via command shells spawned by these agents. This behavior may indicate an AI agent being leveraged to establish persistence or automate malicious actions on a host.
Microsoft Sentinel (KQL)
