Suspicious Scheduled Task Creation with Uncommon Paths or Commands

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•32

Detects suspicious scheduled task creation events by analyzing the task content for unusual paths (e.g., temporary directories, user-writable locations) and the presence of commonly abused command-line utilities or scripting interpreters. This rule aims to identify persistence or execution mechanisms leveraging scheduled tasks.