Scheduled Task Executed From A Suspicious Location (via taskscheduler)

title: Scheduled Task Executed From A Suspicious Location (via taskscheduler)
id: ef0337dd-2758-57a8-88f1-eae98020586a
status: stable
description: This rule detects the execution of Scheduled Tasks where the Program being run is located in an anomalous location or it's an unusale program to be run from a Scheduled Task
references:
    - https://attack.mitre.org/techniques/T1053/005/
    - Internal Research
author: Huntrule Team
date: 2026-05-17
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
logsource:
    product: windows
    service: taskscheduler
    definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
    selection:
        EventID: 129
        Path|contains:
            - 'C:\Windows\Temp\'
            - '\AppData\Local\Temp\'
            - '\Desktop\'
            - '\Downloads\'
            - '\Users\Public\'
            - 'C:\Temp\'
    condition: selection
falsepositives:
    - Unknown
level: medium