rare_sch_task_with_activity
Looks for rare process launch as a scheduled task and activity done by the processes. Author: Jouni Mikkola More info: https://threathunt.blog/hunting-for-malicious-scheduled-tasks/
Microsoft Sentinel (KQL)

Looks for rare process launch as a scheduled task and activity done by the processes. Author: Jouni Mikkola More info: https://threathunt.blog/hunting-for-malicious-scheduled-tasks/

Already have an account?