Scheduled Task Persistence via Script Interpreter (T1053.005)
Detects the creation of scheduled tasks using schtasks.exe or Event ID 4698 that involve scripting interpreters (powershell, wscript, mshta, cmd) and suspicious command line arguments often associated with malicious activity, such as encoded commands, hidden windows, or network resource access, specifically when executing under the SYSTEM account context.
Splunk (SPL)
