Windows Scheduled Task File Writes to System32\Tasks from Suspicious Paths

Alerts on scheduled task storage writes under System32\Tasks originating from suspicious process locations.

FreeUnreviewedSigmahighv1

windows-scheduled-task-file-writes-to-system32-tasks-from-suspicious-paths-80e1f67a

title: Windows Scheduled Task File Writes to System32\Tasks from Suspicious Paths
id: 23e9fb82-7815-4898-9643-4f7310558690
status: test
description: This rule flags file events where a process writes to Windows task storage under \Windows\System32\Tasks. It matters because creating or modifying scheduled tasks is a common way to persist execution and often follows staging from unusual locations such as user AppData, PerfLogs, or systemprofile. Detection relies on Windows file event telemetry that includes the target filename and the creating process image path.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_task_write.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-16
modified: 2022-01-12
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1053
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: \Windows\System32\Tasks
    Image|contains:
      - \AppData\
      - C:\PerfLogs
      - \Windows\System32\config\systemprofile
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 80e1f67a-4596-4351-98f5-a9c3efabac95
    type: derived

What it detects

This rule flags file events where a process writes to Windows task storage under \Windows\System32\Tasks. It matters because creating or modifying scheduled tasks is a common way to persist execution and often follows staging from unusual locations such as user AppData, PerfLogs, or systemprofile. Detection relies on Windows file event telemetry that includes the target filename and the creating process image path.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.