Suspicious Scheduled Task Creation via Masqueraded XML File — Detection Rule
Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence