Windows Scheduled Task Execution From Suspicious Paths

title: Windows Scheduled Task Execution From Suspicious Paths
id: 55bbe7f1-f95d-492e-a666-1b3133a8dfe9
status: test
description: This rule flags Scheduled Task executions where the process path for the executed program resides in commonly abused locations such as C:\Windows\Temp, C:\Temp, user and public temporary directories, Desktop, or Downloads. Attackers often place payloads in these writable or user-controlled paths and then trigger them via Task Scheduler to blend persistence with normal system activity. It relies on Windows Task Scheduler Operational telemetry capturing the created task process event (EventID 129) along with the executed program path.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/taskscheduler/win_taskscheduler_execution_from_susp_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-05
modified: 2023-02-07
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  service: taskscheduler
  definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
  selection:
    EventID: 129
    Path|contains:
      - C:\Windows\Temp\
      - \AppData\Local\Temp\
      - \Desktop\
      - \Downloads\
      - \Users\Public\
      - C:\Temp\
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 424273ea-7cf8-43a6-b712-375f925e481f
    type: derived