Update scheduled task creation.txt

billy-sec · web-flow · commit 03690bb7984e · 2020-08-25T12:02:15.000-06:00
The original intent of the Sigma rule is to identify scheduled tasks created by user accounts, not the system account.
diff --git a/Persistence/scheduled task creation.txt b/Persistence/scheduled task creation.txt
@@ -2,4 +2,4 @@
 //Questions via Twitter: @janvonkirchheim 
 DeviceEvents 
 | where ActionType == "ScheduledTaskCreated"
-  and InitiatingProcessAccountSid == "S-1-5-18"
+  and InitiatingProcessAccountSid != "S-1-5-18"
