hunting-for-scheduled-task-persistence
Runs a hypothesis-driven threat hunt for Windows Scheduled Task persistence (T1053), guiding SIEM/EDR queries against task creation events (e.g. Event ID 4698), suspicious task actions, and unusual scheduling patterns. Use when hunting for scheduled-task persistence, after threat intel flags related campaigns, during incident response, or when alerts fire on schtasks/at.exe activity.
SKILL.md
The description above is the indexed summary. With JavaScript enabled, this page also loads the SKILL.md text from GitHub.