Suspicious Schtasks Execution from AppData Local Folder
Detects the creation of a scheduled task using 'schtasks.exe' that is configured to execute a file from the 'C:\Users\<USER>\AppData\Local' directory. This behavior is often indicative of malware establishing persistence or privilege escalation, as the AppData\Local folder is a common location for user-specific application data and can be written to without administrative privileges. The rule specifically looks for tasks created to run under 'NT AUTHORITY\SYSTEM' or 'SYSTEM' accounts, which would grant elevated privileges to the executed payload.
Sigma
