From asi
Hunts for adversary persistence via Windows scheduled tasks (T1053.005) by analyzing Event ID 4698/4699, suspicious properties, triggers, and execution patterns in Sysmon/Splunk logs.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When proactively hunting for persistence mechanisms in Windows environments
Hunts adversary persistence (T1053.005) in Windows scheduled tasks via event analysis (4698/4699), Sysmon, PowerShell enumeration, and Splunk queries for suspicious creations/executions.
Hunts suspicious Windows scheduled tasks for attacker persistence (T1053.005) by analyzing creation events, task properties, and execution patterns. For threat hunting in Windows environments with Sysmon, Splunk, or Sentinel.
Hunts for adversary persistence via Windows Scheduled Tasks by analyzing creation events, suspicious actions, and unusual patterns. For threat hunting, IR, and security assessments.
Share bugs, ideas, or general feedback.
schtasks /query /fo CSV /v or Get-ScheduledTask PowerShell cmdlet.index=wineventlog EventCode=4698
| spath output=TaskName path=EventData.TaskName
| spath output=TaskContent path=EventData.TaskContent
| where NOT match(TaskName, "(?i)(\\\\Microsoft\\\\|\\\\Windows\\\\)")
| table _time Computer SubjectUserName TaskName TaskContent
index=sysmon EventCode=1 Image="*\\schtasks.exe"
| where match(CommandLine, "(?i)/create")
| where match(CommandLine, "(?i)(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|http|https|\\\\temp\\\\|\\\\appdata\\\\)")
| table _time Computer User CommandLine ParentImage
SecurityEvent
| where EventID == 4698
| extend TaskName = tostring(EventData.TaskName)
| extend TaskContent = tostring(EventData.TaskContent)
| where TaskContent has_any ("powershell", "cmd.exe", "wscript", "http://", "https://", "\\Temp\\", "\\AppData\\")
| project TimeGenerated, Computer, Account, TaskName, TaskContent
schtasks /create /s REMOTE_HOST for execution on other systems.Hunt ID: TH-SCHTASK-[DATE]-[SEQ]
Host: [Hostname]
Task Name: [Full task path]
Action: [Command/Script executed]
Trigger: [Startup/Logon/Timer/Event]
Created By: [User account]
Created From: [Local/Remote]
Creation Time: [Timestamp]
Run As: [Execution account]
Risk Level: [Critical/High/Medium/Low]