Update winevent_scheduled_task_created_within_public_path.yml

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -13,7 +13,7 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s
 
   The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\
   
-  Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.'
+  Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via TaskService. Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.'
 search: '`wineventlog_security` EventCode=4698
   | xmlkv Message 
   | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*")
@@ -26,7 +26,10 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately. 
 references:
   - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
+  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698
   - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
+  - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN
+tags:
   analytic_story:
   - Windows Persistence Techniques
   - Ransomware