From e46ecd2aff64fdf24e129a002003c878af8100e8 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@bsk-consulting.de>
Date: Fri, 17 Mar 2017 08:41:27 +0100
Subject: [PATCH] Rule: Rare scheduled task installs

---
 rules/windows/other/win_rare_schtask_creation.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 rules/windows/other/win_rare_schtask_creation.yml

diff --git a/rules/windows/other/win_rare_schtask_creation.yml b/rules/windows/other/win_rare_schtask_creation.yml
new file mode 100644
index 000000000..e99e6a939
--- /dev/null
+++ b/rules/windows/other/win_rare_schtask_creation.yml
@@ -0,0 +1,15 @@
+title: Rare Scheduled Task Creations
+status: experimental
+description:  
+author: Florian Roth
+logsource:
+    product: windows
+    service: microsoft-windows-taskscheduler
+detection:
+    selection:
+        EventID: 106
+    timeframe: 7d
+    condition: selection | count() by TaskName < 5 
+falsepositives:
+    - Software installation
+level: low