Remote Schedule Task Lateral Movement via SASec — Detection Rule

Detects remote RPC calls to create or execute a scheduled task via SASec

Read the full analysis on IntelFusions