Scheduled Task Persistence via schtasks.exe (T1053.005)
Detects the creation of scheduled tasks using schtasks.exe or Event ID 4698 that involve suspicious binaries (e.g., powershell, mshta), execution from user-writable directories, or tasks configured to run with SYSTEM privileges, which are common indicators of persistence establishment.
Microsoft Sentinel (KQL)
