Sigma rule: Scheduled Task Executed From A Suspicious Location

Rule

Title

Scheduled Task Executed From A Suspicious Location

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-12-05

Modified

2023-02-07

File

rules/windows/builtin/taskscheduler/win_taskscheduler_execution_from_susp_locations.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task

Log source

product

windows

service

taskscheduler

definition

Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger

Detection

selection:
    EventID: 129 # Created Task Process
    Path|contains:
        - 'C:\Windows\Temp\'
        - '\AppData\Local\Temp\'
        - '\Desktop\'
        - '\Downloads\'
        - '\Users\Public\'
        - 'C:\Temp\'
# If you experience FP. Uncomment the filter below and add the specific TaskName with the Program to it
# filter:
#     TaskName: '\Exact\Task\Name'
#     Path: 'Exact\Path'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.execution
• attack.persistence
• attack.t1053.005

MITRE ATT&CK ids this rule names

• T1053.005

References

• Internal Research

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/taskscheduler/win_taskscheduler_execution_from_susp_locations.yml