Powershell Create Scheduled Task

{
  "ps_script": {
    "EventID": 4104,
    "Channel": [
      "Microsoft-Windows-PowerShell/Operational",
      "PowerShellCore/Operational"
    ]
  },
  "selection_cmdlet": {
    "ScriptBlockText
| contains": [
      "New-ScheduledTaskAction",
      "New-ScheduledTaskTrigger",
      "New-ScheduledTaskPrincipal",
      "New-ScheduledTaskSettingsSet",
      "New-ScheduledTask",
      "Register-ScheduledTask"
    ]
  },
  "selection_cimmethod": {
    "ScriptBlockText
| contains
| all": [
      "Invoke-CimMethod",
      "-ClassName",
      "PS_ScheduledTask",
      "-NameSpace",
      "Root\\Microsoft\\Windows\\TaskScheduler"
    ]
  },
  "filter_main_legitimate_scripts": {
    "ScriptBlockText
| contains
| all": [
      "Microsoft.PowerShell.Core\\Export-ModuleMember",
      "Microsoft.Management.Infrastructure.CimInstance",
      "__cmdletization_methodParameter"
    ]
  },
  "condition": "ps_script and (1 of selection_* and not 1 of filter_main_*)"
}

False Positives

• ⚠ Unknown