Windows Suspicious Scheduled Task File Write Targeting System32 Tasks
Alerts on scheduled task storage writes under System32\Tasks originating from suspicious process locations.
- Product
- windows
- Category
- file_event
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-11-16
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies file activity where a process writes to paths under \Windows\System32\Tasks and the writing process executable is located in or originates from suspicious locations such as \AppData\, C:\PerfLogs, or \Windows\System32\config\systemprofile. Attackers often use scheduled tasks for persistence or privilege-related execution, and writing task definitions to this location is a key indicator of that behavior. It relies on Windows file event telemetry capturing both the target filename path and the source process image path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious Scheduled Task File Write Targeting System32 Tasks
id: 23e9fb82-7815-4898-9643-4f7310558690
status: test
description: This rule identifies file activity where a process writes to paths under \Windows\System32\Tasks and the writing process executable is located in or originates from suspicious locations such as \AppData\, C:\PerfLogs, or \Windows\System32\config\systemprofile. Attackers often use scheduled tasks for persistence or privilege-related execution, and writing task definitions to this location is a key indicator of that behavior. It relies on Windows file event telemetry capturing both the target filename path and the source process image path.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_task_write.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-16
modified: 2022-01-12
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.t1053
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains: \Windows\System32\Tasks
Image|contains:
- \AppData\
- C:\PerfLogs
- \Windows\System32\config\systemprofile
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 80e1f67a-4596-4351-98f5-a9c3efabac95
type: derived