Powershell Create Scheduled Task

{
  "selection_cmdlet": {
    "ScriptBlockText
| contains": [
      "New-ScheduledTaskAction",
      "New-ScheduledTaskTrigger",
      "New-ScheduledTaskPrincipal",
      "New-ScheduledTaskSettingsSet",
      "New-ScheduledTask",
      "Register-ScheduledTask"
    ]
  },
  "selection_cimmethod": {
    "ScriptBlockText
| contains
| all": [
      "Invoke-CimMethod",
      "-ClassName",
      "PS_ScheduledTask",
      "-NameSpace",
      "Root\\Microsoft\\Windows\\TaskScheduler"
    ]
  },
  "filter_main_legitimate_scripts": {
    "ScriptBlockText
| contains
| all": [
      "Microsoft.PowerShell.Core\\Export-ModuleMember",
      "Microsoft.Management.Infrastructure.CimInstance",
      "__cmdletization_methodParameter"
    ]
  },
  "condition": "1 of selection_* and not 1 of filter_main_*"
}

False Positives

• ⚠ Unknown