 Samirbous
|
0eacf484a0
|
[New Rule] Scheduled Task Created by a Windows Script (#649)
* [New Rule] Scheduled Task Created via Windows Scripts
* added powershell
* Update persistence_local_scheduled_task_scripting.toml
* Update rules/windows/persistence_local_scheduled_task_scripting.toml
Co-authored-by: dstepanic17 <57736958+dstepanic17@users.noreply.github.com>
* increased maxspan as per Dan sugg
* eql syntax
* eql syntax
* ecs_version
* Update rules/windows/persistence_local_scheduled_task_scripting.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: dstepanic17 <57736958+dstepanic17@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
|
2020-12-03 23:10:51 +01:00 |
|