Suspicious Modification of Scheduled Tasks

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•26

Detects when an attacker attempts to modify an existing scheduled task to execute a payload from suspicious locations. This technique allows attackers to bypass detection mechanisms that primarily focus on the creation of new scheduled tasks, by instead altering a legitimate task to include their malicious code.