Suspicious Scheduled Task Update

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•36

Detects updates to scheduled tasks (EventID 4702) where the new task content (`TaskContentNew`) contains suspicious keywords. These keywords include common temporary or user-writable directories often used by malware for staging or execution, combined with suspicious commands or scripting interpreters. This rule aims to identify adversaries establishing persistence or executing malicious code via scheduled tasks.