Windows Scheduled Task Execution of Uncommon Binaries (LOLBin Suspicion)

Alerts when a Windows Scheduled Task runs a process from a set of uncommon/suspicious binary paths.

FreeReviewedSigma · Medium · v2

Product: windows
Service: taskscheduler
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-12-05
Updated: 2026-07-31

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1053.005Scheduled Task
Persistence
- T1053.005Scheduled Task
Priv Esc
- T1053.005Scheduled Task
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows Task Scheduler events indicating a scheduled task created/executed process where the image path ends with selected executables commonly abused for execution (for example, calc.exe, cscript.exe, mshta.exe, wscript.exe, regsvr32.exe). Attackers may use scheduled tasks to persist and run these living-off-the-land binaries in an unexpected context to evade interactive detection and user scrutiny. It relies on Windows Task Scheduler operational telemetry capturing the event and the process image path used for the task.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange

Malicious SYSTEM Persistence via Scheduled Task Running rundll32 at Startup (via process_creation)

Suspicious Per-Minute SYSTEM Scheduled Task With Highest Privileges

Suspicious Scheduled Task Executing Rundll32 DLL Export by Ordinal

Suspicious Scheduled Task CacheTask Reconfigured to Run as SYSTEM

Malicious NodeSnake RAT Persistence via Scheduled Task and Node.js (via process_creation)

Malicious Scheduled Task Masquerading as Windows Defender Sync via schtasks (via process_creation)

Suspicious Scheduled Task Creation Launching mshta via schtasks (via process_creation)

Suspicious Service or Task Named windowsinspectionupdate (via process_creation)

Suspicious Scheduled Task Creation Referencing dllFake Batch Scripts (via process_creation)

Windows Scheduled Task Execution of Uncommon Binaries (LOLBin Suspicion)

Pivot detection · T1053.005 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-scheduled-task-execution-of-uncommon-binaries-via-taskscheduler-f0767f15

title: Windows Scheduled Task Execution of Uncommon Binaries (LOLBin Suspicion)
id: 76ff2ec4-b5f6-4c23-9e25-6ca5d3b31fde
status: test
description: This rule matches Windows Task Scheduler events indicating a scheduled task created/executed process where the image path ends with selected executables commonly abused for execution (for example, calc.exe, cscript.exe, mshta.exe, wscript.exe, regsvr32.exe). Attackers may use scheduled tasks to persist and run these living-off-the-land binaries in an unexpected context to evade interactive detection and user scrutiny. It relies on Windows Task Scheduler operational telemetry capturing the event and the process image path used for the task.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-05
modified: 2023-02-07
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  service: taskscheduler
  definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
  selection:
    EventID: 129
    Path|endswith:
      - \calc.exe
      - \cscript.exe
      - \mshta.exe
      - \mspaint.exe
      - \notepad.exe
      - \regsvr32.exe
      - \wscript.exe
  condition: selection
falsepositives:
  - False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule
level: medium
license: DRL-1.1
related:
  - id: f0767f15-0fb3-44b9-851e-e8d9a6d0005d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL