Dual Persistence via Startup and Scheduled Task

sequence with maxspan=3m
 [any where event.category in ("registry", "file") and
  process.executable : ("?:\\*", "\\Device\\Mup*") and
  event.action != "deletion" and user.id like ("S-1-5-21*", "S-1-12-*") and 
  not process.code_signature.status like ("trusted", "errorExpired", "errorCode_endpoint*") and 
   (
    (registry.data.strings != null and 
     not registry.data.strings : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*") and
     registry.path :
              ("H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*", 
	       "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
	       "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*", 
	       "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*", 
	       "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load", 
	       "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell", 
	       "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell", 
	       "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript", 
	       "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit", 
	       "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell", 
	       "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script", 
	       "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script", 
	       "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script", 
	       "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script", 
	       "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath", 
	       "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec", 
	       "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun")) or
    (file.name != null and file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" and not file.name : "desktop.ini")
   )] by process.entity_id
  [file where event.action != "deletion" and
   file.path : "?:\\Windows\\System32\\Tasks\\*" and file.name != null] by Effective_process.entity_id