Scheduled task persistence via schtasks.exe pointing at unsigned/user-writable binaries
Detects the creation of scheduled tasks using schtasks.exe where the initiating process is unsigned or the target binary path is located in common user-writable or temporary directories, a technique frequently used by malware for persistence.
Microsoft Sentinel (KQL)
