Scheduled TaskCache Change by Uncommon Program (4720b7df-40c3-48fd-bbdf-fd4b3c464f0d)

Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Scheduled Task/Job - T1053 (35dd844a-b219-4e2b-a6bb-efa9a75995a9)	Attack Pattern	Scheduled TaskCache Change by Uncommon Program (4720b7df-40c3-48fd-bbdf-fd4b3c464f0d)	Sigma-Rules	1
Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9)	Attack Pattern	Scheduled TaskCache Change by Uncommon Program (4720b7df-40c3-48fd-bbdf-fd4b3c464f0d)	Sigma-Rules	1
Scheduled Task/Job - T1053 (35dd844a-b219-4e2b-a6bb-efa9a75995a9)	Attack Pattern	Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9)	Attack Pattern	2