Suspicious Scheduled Task Name As GUID

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•16

Detects the creation of a scheduled task where the task name (`/TN`) is a GUID-like string. This behavior is often observed in malware or advanced persistent threats to maintain persistence or execute malicious code, as using GUIDs can help obfuscate the task's purpose or make it less conspicuous among legitimate tasks.