Schtasks From Suspicious ProgramData Folders
This rule detects the creation of scheduled tasks using 'schtasks.exe' where the command line includes common scripting interpreters (powershell, pwsh, cmd) and specifies a suspicious folder path like 'C:\ProgramData\' or '%ProgramData%'. This combination is often used by adversaries for persistence or privilege escalation by scheduling malicious code to run from a location typically used for application data, which can be less monitored than system directories.
Sigma
