All Detections

Scheduled Task CMD Payload Chain

avatar
Ankit Mehta@Secvyn
updated Jun 30, 2026001

Detects the command shell execution chain used by scheduled tasks to launch ransomware payloads (run.bat, run.exe) distributed via malicious GPOs

Microsoft Sentinel (KQL)