Scheduled TaskCache Change by Uncommon Program

SigmaHQ Detections@sigmaHQ

•updated Nov 10, 2025•0•0•1

Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious