diff --git a/rules/windows/file/file_event/file_event_win_scheduled_task_creation.yml b/rules/windows/file/file_event/file_event_win_scheduled_task_creation.yml index 7a0c1e2508f..dbcd9f762fe 100644 --- a/rules/windows/file/file_event/file_event_win_scheduled_task_creation.yml +++ b/rules/windows/file/file_event/file_event_win_scheduled_task_creation.yml @@ -1,7 +1,7 @@ title: Scheduled Task Created - FileCreation id: a762e74f-4dce-477c-b023-4ed81df600f9 status: experimental -description: Detects the creation of scheduled task. +description: Detects the creation of a scheduled task via file creation. references: - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/task_scheduling/ - https://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5 @@ -25,5 +25,5 @@ detection: - ':\Windows\Tasks\' condition: selection falsepositives: - - Likely + - Normal behaviour on Windows level: low diff --git a/rules/windows/registry/registry_event/registry_event_scheduled_task_creation.yml b/rules/windows/registry/registry_event/registry_event_scheduled_task_creation.yml index aa1841b3048..f8a92e67956 100644 --- a/rules/windows/registry/registry_event/registry_event_scheduled_task_creation.yml +++ b/rules/windows/registry/registry_event/registry_event_scheduled_task_creation.yml @@ -1,7 +1,7 @@ title: Scheduled Task Created - Registry id: 93ff0ceb-e0ef-4586-8cd8-a6c277d738e3 status: experimental -description: Detects the creation of a scheduled task. +description: Detects the creation of a scheduled task via Registry keys. references: - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/task_scheduling/ - https://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5 @@ -24,5 +24,5 @@ detection: - '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\' condition: selection falsepositives: - - Likely + - Normal behaviour on Windows level: low