Elastic medium stable eql

Remote Scheduled Task Creation via RPC

Identifies scheduled task creation from a remote source. This could be indicative of adversary lateral movement.

View Source

Detection Logic

iam where host.os.type == "windows" and event.action == "scheduled-task-created" and
 winlog.event_data.RpcCallClientLocality : "0" and winlog.event_data.ClientProcessId : "0"

Field Validations

Loading…

Comments (0)

Loading comments...