This detection looks for a suspicious Windows activity where cmd.exe is used to write a Windows Scheduled Task XML definition to disk via the echo command. It targets command lines that combine echo with the Task Scheduler XML namespace (xmlns) and a Task version, which is atypical for legitimate software. The approach is to surface instances where an attacker or malware constructs a task definition on-the-fly from the console to establish persistence, periodically relaunch the payload, and then delete the XML to hinder forensic analysis. Telemetry comes from endpoint EDR sources (Sysmon Process Create Event 1, Windows Security Event 4688, and CrowdStrike ProcessRollup2) and is mapped to the Endpoint data model. The SPL query looks for cmd.exe processes with command lines containing patterns such as echo, Task version, and xmlns with the Windows task schema, aggregates by destination, user, and process context, and normalizes timestamps for alerting. The resulting finding indicates a scheduled task XML was built via console echo on a specific host by a user, consistent with persistence techniques tracked as MITRE ATT&CK T1053.005. This rule emphasizes Living Off The Land and browser hijacker/adware droppers that misuse Task Scheduler to relaunch and conceal activity. False positives are unlikely but possible in environments with custom installers or administrative automation that generates Task Scheduler XML through command-line constructs; tuning via parent process context is advised. The analytic integrates with Splunk CIM-normalized endpoint telemetry and leverages the provided data sources to detect this specific workflow across Windows endpoints.