Tasks Folder Write/Modification for Evasion

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

This rule detects attempts to write or modify files within the `C:\Windows\System32\Tasks\` or `C:\Windows\SysWow64\Tasks\` directories using common command-line utilities. Adversaries may leverage the globally writable nature of these folders to achieve privilege escalation, persistence, or defense evasion by loading custom assemblies or scripts into legitimate Windows processes like cscript, wscript, regsvr32, mshta, or eventvwr.