Scheduled Task Creation From Suspicious Parent Location
This rule detects the creation of scheduled tasks using `schtasks.exe` where the parent process originates from a suspicious temporary or user-specific directory. Adversaries often use scheduled tasks for persistence and privilege escalation, and executing the task creation utility from locations like `Temp`, `AppData\Local`, `AppData\Roaming`, `Temporary Internet Files`, or `Users\Public` can indicate malicious activity. Multiple malware strains have been observed employing this technique.
Sigma
