Threat Hunt: Suspicious Scheduled Task - FoxKitten
This query detects potential Fox Kitten threat actor activity by analyzing ScheduledTaskCreated events. It filters for suspicious task names (e.g., "update", "sync", "\Microsoft\Windows\EnterpriseMgmt"), non-system accounts, and risky commands (e.g., powershell, certutil). It also extracts task details, assigns risk levels (HIGH, MEDIUM, LOW) based on command patterns, and orders results by risk and timestamp for prioritized investigation.
Microsoft Sentinel (KQL)
