Scheduled Task Creation From Potential Suspicious Parent Location — Detection Rule
Detects the execution of "schtasks.exe" from a parent that is located in a potentially suspicious location. Multiple malware strains were seen exhibiting a similar behavior in order to achieve persistence.