Find hidden scheduled tasks
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ScheduledTaskRegistered
| parseXml(TaskXml)
| Hidden:=rename(Task.Settings.Hidden)
| Hidden=/true/i
| table([aid,Hidden,TaskXml],limit=1000)hidden_scheduled_tasks.yml
T1053.005
CrowdStrike
Hunting
Endpoint
Insight
2025-08-06
2025-08-28
