Scheduled Task Executed Unusual LOLBIN (via taskscheduler)

title: Scheduled Task Executed Unusual LOLBIN (via taskscheduler)
id: 314e3733-4cc0-57c5-b9b9-3fb8858b292b
status: stable
description: This rule detects the execution of Scheduled Tasks where the program being run is located in an anomalous location or where it is an unusual program to be run from a Scheduled Task
references:
    - https://attack.mitre.org/techniques/T1053/005/
    - Internal Research
author: Huntrule Team
date: 2026-02-03
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
logsource:
    product: windows
    service: taskscheduler
    definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
    selection:
        EventID: 129
        Path|endswith:
            - '\calc.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\mspaint.exe'
            - '\notepad.exe'
            - '\regsvr32.exe'
            - '\wscript.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium