Anthropic-Cybersecurity-Skills/skills/hunting-for-suspicious-scheduled-tasks/assets/template.md

Suspicious Scheduled Task Hunt Template

Hunt Metadata

Field	Value
Hunt ID	TH-SCHTASK-YYYY-MM-DD-NNN
Analyst
Date
Status	[ ] In Progress / [ ] Complete

Hypothesis

Adversaries have established persistence via scheduled tasks that execute malicious payloads at system startup, user logon, or recurring intervals.

Task Findings

#	Host	Task Name	Action	Trigger	Created By	Created Time	Risk
1

Recommendations

1. Remove: [Malicious scheduled tasks]
2. Investigate: [Executed payloads and their impact]
3. Detect: [Deploy 4698 monitoring rules]
4. Baseline: [Establish known-good task inventory]