ADAudit Plus Scheduled Task Created on Domain System
Detects scheduled task creation observed through ADAudit Plus. Scheduled tasks are a long-standing persistence and remote execution mechanism, and seeing them at the directory audit layer catches creation across the domain rather than host by host. Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS' and action='TASK_CREATED' | groupby user, object, commandline, domain
Sigma
