Find tasks scheduled by logon type
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ScheduledTaskRegistered
| parseXml(TaskXml)
| LogonType:=rename(Task.Principals.Principal.LogonType)
| LogonType=* // Remove this line if you don't care if it's empty
| table([aid, LogonType, TaskXml], limit=1000)task_scheduled_by_logon_type.yml
T1053.005
CrowdStrike
Hunting
Endpoint
Insight
2025-08-06
2025-08-28
