Suspicious Scheduled Task Creation From Public Directory
Detects the creation of a scheduled task executing binaries or scripts from the \Users\Public\ directory. This behavior has been observed in Tropic Trooper campaigns to maintain persistence and execute malicious payloads via the AdaptixC2 agent, but applies broadly to threat actors staging in the Public folder.
Sigma
