Low Frequency of Process Execution via Windows Scheduled Task by Unique Agent

from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*
| where  @timestamp > now(-) - 7 day
| where host.os.family == "windows" and event.category == "process" and
  event.action in ("start", "Process creation") and process.code_signature.trusted != true and
  /* child process of the Tasks Schedule service */
  process.parent.name == "svchost.exe" and ends_with(process.parent.command_line, "Schedule")
| stats hosts = count_distinct(host.id) by process.hash.sha256, process.name
 /* unique hash observed in one unique agent */
| where hosts == 1

False Positives

• ⚠ Windows security event 4688 lacks `process.parent.command_line` needed for this hunt to identify the Schedule `svchost` instance.
• ⚠ Unique `process.hash.sha256` and agent is not necessarily malicious, however this helps surface signals worth further investigation.