Scheduled Task Created via COM Launching pythonw.exe ss.py
Detects the creation of a Windows scheduled task where the action involves executing pythonw.exe with a specific script named 'ss.py'. This rule specifically looks for task registration events (Event ID 4698) where the action command line contains both 'pythonw.exe' and 'ss.py', while excluding tasks created by 'schtasks.exe' to focus on non-standard creation methods often used by malware or living-off-the-land techniques to register persistence via the COM interface.
Sigma
