Sigma rule: Scheduled Task Executed Uncommon LOLBIN

Rule

Title

Scheduled Task Executed Uncommon LOLBIN

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-12-05

Modified

2023-02-07

File

rules/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task

Log source

product

windows

service

taskscheduler

definition

Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger

Detection

selection:
    EventID: 129 # Created Task Process
    Path|endswith:
        - '\calc.exe'
        - '\cscript.exe'
        - '\mshta.exe'
        - '\mspaint.exe'
        - '\notepad.exe'
        - '\regsvr32.exe'
        # - '\rundll32.exe'
        - '\wscript.exe'
# filter_system:
#     Path|endswith: '\rundll32.exe'
#     TaskName|startswith: '\Microsoft\Windows\'
# condition: selection and not 1 of filter_*
condition: selection

False positives (as the rule lists them)

• False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule

Tags

• attack.privilege-escalation
• attack.execution
• attack.persistence
• attack.t1053.005

MITRE ATT&CK ids this rule names

• T1053.005

References

• Internal Research

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml