Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE — Detection Rule

Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware

Read the full analysis on IntelFusions