Most Popular Detection 2026: Suspicious schtasks.exe /create SYSTEM or Onlogon Persistence
Detects the creation of scheduled tasks using the 'schtasks.exe' utility with either system-level privileges ('/ru SYSTEM') or persistent triggers ('/sc onlogon' or '/sc onstart'). The rule filters out commonly trusted parent processes, highlighting potential persistence mechanisms established by unauthorized or unusual processes.
Microsoft Sentinel (KQL)
