Scheduled Task Creation Masquerading as System Processes (9f8573c9-22b4-40e3-89c1-72bc2b8d49ab)

Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Scheduled Task Creation Masquerading as System Processes (9f8573c9-22b4-40e3-89c1-72bc2b8d49ab)	Sigma-Rules	Match Legitimate Resource Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2)	Attack Pattern	1
Scheduled Task Creation Masquerading as System Processes (9f8573c9-22b4-40e3-89c1-72bc2b8d49ab)	Sigma-Rules	Masquerade Task or Service - T1036.004 (7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c)	Attack Pattern	1
Scheduled Task Creation Masquerading as System Processes (9f8573c9-22b4-40e3-89c1-72bc2b8d49ab)	Sigma-Rules	Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9)	Attack Pattern	1
Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0)	Attack Pattern	Match Legitimate Resource Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2)	Attack Pattern	2
Masquerade Task or Service - T1036.004 (7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c)	Attack Pattern	Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0)	Attack Pattern	2
Scheduled Task - T1053.005 (005a06c6-14bf-4118-afa0-ebcd8aebb0c9)	Attack Pattern	Scheduled Task/Job - T1053 (35dd844a-b219-4e2b-a6bb-efa9a75995a9)	Attack Pattern	2