To monitor Scheduled Tasks.
This path is where they are stored.
C:\Windows\System32\Tasks\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule...
A file system auditing template could be created and monitor this folder for changes.
It requires the CA file system separate license.
C:\Windows\System32\Tasks\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule...
