Suspicious Change Of Scheduled Tasks (via process_creation)

This rule detects when an adversary tries to modify an already existing scheduled tasks to run from an anomalous location Attackers can create a simple looking task to avoid detection on creation as it's frequently the most focused on Instead they modify the task after creation to include their hostile payload