Who rated this post

Hi @CraigV123, thanks for reaching us using the Live Community.

You can try a XQL Query to retrieve the scheduled tasks created with any command:

dataset = xdr_data
| filter action_process_image_command_line contains "schtasks"

With some tuning, this XQL query can be also used as a BIOC rule.

You can also try using the Windows Event Logs:

dataset = xdr_data
| filter event_type = ENUM.EVENT_LOG
| filter action_evtlog_event_id = 4698
| fields action_evtlog_provider_name, action_evtlog_event_id, event_type, action_evtlog_message

Having the task names, you can create a script to run in the affected endpoints to remove the tasks. You can even also use scripts to get the scheduled tasks in the endpoints and if the name matches, remove it.

If this post answers your question, please mark it as the solution.