Scheduled Tasks with unsigned Binaries
This rule detects scheduled tasks that execute unsigned binaries. It specifically looks for processes initiated by 'svchost.exe -k netsvcs -p -s Schedule', which is indicative of a scheduled task, and then filters for binaries that are not signed and have low global prevalence. This can help identify malicious code executed via scheduled tasks that attempts to evade detection by using unsigned executables.
Microsoft Sentinel (KQL)
