Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks.
安装
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-malicious-scheduled-tasks-with-sysmonnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-malicious-scheduled-tasks-with-sysmon -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-malicious-scheduled-tasks-with-sysmon -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-malicious-scheduled-tasks-with-sysmongh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-malicious-scheduled-tasks-with-sysmongit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-malicious-scheduled-tasks-with-sysmon ~/.claude/skills/detecting-malicious-scheduled-tasks-with-sysmon # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-malicious-scheduled-tasks-with-sysmon ~/.agents/skills/detecting-malicious-scheduled-tasks-with-sysmon # Codex, Cursor, Gemini CLI, Copilot, OpenCode