Scheduled task creation via DSC PSDscResources spawned by ConfigurationRemotingServer
Detects the execution of schtasks.exe originating from Windows system management or package management server processes (ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe). This activity may indicate administrative task automation or potentially malicious persistence and execution attempts using legitimate system binaries.
Splunk (SPL)
