Cleaned up signature descriptions and metadata.

queries/windows/scheduled_tasks_creation.yml

@@ -1,11 +1,9 @@
 title: Scheduled Tasks Creation
-description: Our goal with this query is to detect any schtasks /create command as
-  well as any use of the New-ScheduledTask* cmdlets from powershell, and to prevent
-  noise from services and updates we'll exclude a list of system "trusted" SrcProcParentName
-  executables.
+description: Detection of schtasks /create command as well as any use of the New-ScheduledTask* 
+  cmdlets from powershell.
 author: keyboardcrunch
 date: 10/10/2020
-modified: null
+modified: 05/12/2020
 mitre:
    tactic: Execution, Persistence
    technique: T1053
@@ -14,6 +12,8 @@ operating_system: windows
 query: (( TgtProcName = "schtasks.exe" AND TgtProcCmdLine ContainsCIS "/create" )
   OR ( SrcProcCmdLine ContainsCIS "New-ScheduledTask" OR SrcProcCmdScript  ContainsCIS
   "New-ScheduledTask" )) AND SrcProcParentName Not In ("services.exe","OfficeClickToRun.exe")
-false_positives: null
-tags: null
+false_positives: 
+   - NPCAP driver task
+   - Legitimate task creation
+tags: