Windows Scheduled Task Execution of Uncommon Binaries (LOLBin Suspicion)

Alerts when a Windows Scheduled Task runs a process from a set of uncommon/suspicious binary paths.

FreeReviewedSigma · Medium · v2

Product: windows
Service: taskscheduler
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-12-05
Updated: 2026-07-31

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1053.005Scheduled Task
Persistence
- T1053.005Scheduled Task
Priv Esc
- T1053.005Scheduled Task
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows Task Scheduler events indicating a scheduled task created/executed process where the image path ends with selected executables commonly abused for execution (for example, calc.exe, cscript.exe, mshta.exe, wscript.exe, regsvr32.exe). Attackers may use scheduled tasks to persist and run these living-off-the-land binaries in an unexpected context to evade interactive detection and user scrutiny. It relies on Windows Task Scheduler operational telemetry capturing the event and the process image path used for the task.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange

Malicious CloudZ RAT Persistence via schtasks Running regasm.exe

Suspicious Scheduled Task Creation for WSPrint Persistence by UAT-9244

Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell

Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware

Malicious Scheduled Task Masquerading as Edge Update Running From Temp (via process_creation)

Suspicious Scheduled Task Created From XML Definition (via process_creation)

Malicious Scheduled Task Masquerade for Zardoor Persistence (via process_creation)

Malicious BugSleep Scheduled Task Persistence with Sample Comment

Suspicious Scheduled Task Masquerading As OneDrive (via process_creation)

Windows Scheduled Task Execution of Uncommon Binaries (LOLBin Suspicion)

Pivot detection · T1053.005 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-scheduled-task-execution-of-uncommon-binaries-via-taskscheduler-f0767f15

title: Windows Scheduled Task Execution of Uncommon Binaries (LOLBin Suspicion)
id: 76ff2ec4-b5f6-4c23-9e25-6ca5d3b31fde
status: test
description: This rule matches Windows Task Scheduler events indicating a scheduled task created/executed process where the image path ends with selected executables commonly abused for execution (for example, calc.exe, cscript.exe, mshta.exe, wscript.exe, regsvr32.exe). Attackers may use scheduled tasks to persist and run these living-off-the-land binaries in an unexpected context to evade interactive detection and user scrutiny. It relies on Windows Task Scheduler operational telemetry capturing the event and the process image path used for the task.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-05
modified: 2023-02-07
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  service: taskscheduler
  definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
  selection:
    EventID: 129
    Path|endswith:
      - \calc.exe
      - \cscript.exe
      - \mshta.exe
      - \mspaint.exe
      - \notepad.exe
      - \regsvr32.exe
      - \wscript.exe
  condition: selection
falsepositives:
  - False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule
level: medium
license: DRL-1.1
related:
  - id: f0767f15-0fb3-44b9-851e-e8d9a6d0005d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL