Find tasks scheduled by user ID
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ScheduledTaskRegistered
| parseXml(TaskXml)
| UserId:=rename(Task.Principals.Principal.UserId)
| table([aid, UserId, TaskXml], limit=1000)tasks_scheduled_by_user_ID.yml
T1053.005
CrowdStrike
Hunting
Endpoint
Insight
2025-08-06
2025-08-28
