Massive remote schedule task creation via named pipes (CrackMapExec with ATexec)

Detects scenarios where an attacker remotely creates a scheduled task on multiple hosts over named pipes to execute commands or elevate privileges.