Suspicious Scheduled Task Creation for Persistence (T1053.005)

Ibrahim Saud@tektrix

•updated 5 days ago•0•0•0

This rule detects the creation of scheduled tasks using either 'schtasks.exe' or PowerShell ('powershell.exe', 'pwsh.exe') with suspicious parameters. It flags tasks created in temporary directories (e.g., AppData, Temp, ProgramData, Windows\Temp) or tasks executed with 'highest' privileges or hidden configurations, often used for persistence or lateral movement.