Windows Scheduled Task File Creation Activity (File Event)
Flags file creation under Windows scheduled task directories that may indicate new scheduled task persistence.
- Product
- windows
- Category
- file_event
- Author
- Center for Threat Informed Defense (CTID) Summiting the Pyramid Team (SigmaHQ), DRL 1.1
- Published
- 2023-09-27
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file creation events targeting Windows Task Scheduler directories, including System32\Tasks, SysWOW64\Tasks, and the legacy Tasks folder. Attackers commonly use scheduled tasks to persist execution across reboots, so filesystem activity in these paths can indicate task creation attempts. The detection relies on Windows file event telemetry that includes the created file path (TargetFilename).
Reporting behind it
- center-for-threat-informed-defense.github.iohttps://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/task_scheduling/
- posts.specterops.iohttps://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_scheduled_task_creation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Scheduled Task File Creation Activity (File Event)
id: 9e5dc11f-b31e-4fc6-84a1-913bf800313a
status: test
description: This rule flags file creation events targeting Windows Task Scheduler directories, including System32\Tasks, SysWOW64\Tasks, and the legacy Tasks folder. Attackers commonly use scheduled tasks to persist execution across reboots, so filesystem activity in these paths can indicate task creation attempts. The detection relies on Windows file event telemetry that includes the created file path (TargetFilename).
references:
- https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/task_scheduling/
- https://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_scheduled_task_creation.yml
author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team, Huntrule Team
date: 2023-09-27
tags:
- attack.execution
- attack.persistence
- attack.privilege-escalation
- attack.t1053.005
- attack.s0111
- car.2013-08-001
- detection.threat-hunting
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains:
- :\Windows\System32\Tasks\
- :\Windows\SysWOW64\Tasks\
- :\Windows\Tasks\
condition: selection
falsepositives:
- Normal behaviour on Windows
level: low
license: DRL-1.1
related:
- id: a762e74f-4dce-477c-b023-4ed81df600f9
type: derived