LoFP LoFP / some installers were seen using this method of creation unfortunately. filter them in your environment

Techniques

Sample rules

Suspicious Schtasks Schedule Type With High Privileges

Description

Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type

Detection logic

condition: all of selection_*
selection_img:
- Image|endswith: \schtasks.exe
- OriginalFileName: schtasks.exe
selection_privs:
  CommandLine|contains:
  - NT AUT
  - ' SYSTEM'
  - HIGHEST
selection_time:
  CommandLine|contains:
  - ' ONLOGON '
  - ' ONSTART '
  - ' ONCE '
  - ' ONIDLE '