Windows Scheduled Task Execution of Uncommon Binaries (LOLBin Suspicion)
Alerts when a Windows Scheduled Task runs a process from a set of uncommon/suspicious binary paths.
- Product
- windows
- Service
- taskscheduler
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-05
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Windows Task Scheduler events indicating a scheduled task created/executed process where the image path ends with selected executables commonly abused for execution (for example, calc.exe, cscript.exe, mshta.exe, wscript.exe, regsvr32.exe). Attackers may use scheduled tasks to persist and run these living-off-the-land binaries in an unexpected context to evade interactive detection and user scrutiny. It relies on Windows Task Scheduler operational telemetry capturing the event and the process image path used for the task.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Scheduled Task Execution of Uncommon Binaries (LOLBin Suspicion)
id: 76ff2ec4-b5f6-4c23-9e25-6ca5d3b31fde
status: test
description: This rule matches Windows Task Scheduler events indicating a scheduled task created/executed process where the image path ends with selected executables commonly abused for execution (for example, calc.exe, cscript.exe, mshta.exe, wscript.exe, regsvr32.exe). Attackers may use scheduled tasks to persist and run these living-off-the-land binaries in an unexpected context to evade interactive detection and user scrutiny. It relies on Windows Task Scheduler operational telemetry capturing the event and the process image path used for the task.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-05
modified: 2023-02-07
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.t1053.005
logsource:
product: windows
service: taskscheduler
definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
selection:
EventID: 129
Path|endswith:
- \calc.exe
- \cscript.exe
- \mshta.exe
- \mspaint.exe
- \notepad.exe
- \regsvr32.exe
- \wscript.exe
condition: selection
falsepositives:
- False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule
level: medium
license: DRL-1.1
related:
- id: f0767f15-0fb3-44b9-851e-e8d9a6d0005d
type: derived