Scheduled Task Executed From A Suspicious Location
Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or it's an unusual program to be run from a Scheduled Task. This rule specifically looks for Event ID 129 (Created Task Process) in the Task Scheduler Operational logs and checks if the executable path contains common temporary or user-download directories.
Sigma
