Windows Task Scheduler DLL (taskschd.dll) Loaded from Uncommon Paths by a Process

Flags taskschd.dll being loaded by a process from Temp/public/user directories commonly abused for malicious activity.

FreeUnreviewedSigmalowv1

windows-task-scheduler-dll-taskschd-dll-loaded-from-uncommon-paths-by-a-process-3b92a1d0

title: Windows Task Scheduler DLL (taskschd.dll) Loaded from Uncommon Paths by a Process
id: 65986d28-6ef3-4f7d-ba3d-e17a1143cca6
status: test
description: This rule identifies when taskschd.dll is loaded by a process whose image path includes potentially suspicious or uncommon locations such as Temp, public user directories, or user-accessible folders. Loading taskschd.dll can be indicative of an application using Windows Task Scheduler capabilities, which attackers may leverage for persistence or execution. The detection relies on process image load telemetry capturing the loaded module name (or OriginalFileName) and the loading process image path.
references:
  - https://www.logpoint.com/en/blog/shenanigans-of-scheduled-tasks/
  - https://x.com/Max_Mal_/status/1826179497084739829
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_dll_taskschd_by_process_in_potentially_suspicious_location.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-09-02
tags:
  - attack.persistence
  - attack.execution
  - attack.privilege-escalation
  - attack.t1053.005
  - detection.threat-hunting
logsource:
  category: image_load
  product: windows
detection:
  selection_dll:
    - ImageLoaded|endswith: \taskschd.dll
    - OriginalFileName: taskschd.dll
  selection_paths:
    Image|contains:
      - :\Temp\
      - :\Users\Public\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
      - \Desktop\
      - \Downloads\
  condition: all of selection_*
falsepositives:
  - Some installers might generate false positives, apply additional filters accordingly.
level: low
license: DRL-1.1
related:
  - id: 3b92a1d0-8d4b-4d28-a1b4-1e29d49a6a3e
    type: derived

What it detects

This rule identifies when taskschd.dll is loaded by a process whose image path includes potentially suspicious or uncommon locations such as Temp, public user directories, or user-accessible folders. Loading taskschd.dll can be indicative of an application using Windows Task Scheduler capabilities, which attackers may leverage for persistence or execution. The detection relies on process image load telemetry capturing the loaded module name (or OriginalFileName) and the loading process image path.

Known false positives

Some installers might generate false positives, apply additional filters accordingly.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.