Remote Task Creation via ATSVC Named Pipe - Zeek

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•1

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe