DeviceProcessEvents
| where FolderPath endswith "\\schtasks.exe" and ProcessCommandLine contains " /create "
