Windows Task Scheduler DLL Loaded From Uncommon Directory
Flags taskschd.dll being loaded by a process from Temp/public/user directories commonly abused for malicious activity.
- Product
- windows
- Category
- image_load
- Author
- Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
- Published
- 2024-09-02
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags when taskschd.dll is loaded and the loading image path contains one of several uncommon or potentially suspicious locations (for example Temp, Public, Downloads, Desktop). Loading this module may be associated with applications that can interact with scheduled tasks via the Windows task scheduler component. Investigation should focus on the loading process and its behavior to determine whether the DLL load is expected (e.g., during an installer) or indicative of abuse. Telemetry required includes image/DLL load events with the loaded DLL name and the image path that performed the load.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Task Scheduler DLL Loaded From Uncommon Directory
id: 65986d28-6ef3-4f7d-ba3d-e17a1143cca6
status: test
description: This rule flags when taskschd.dll is loaded and the loading image path contains one of several uncommon or potentially suspicious locations (for example Temp, Public, Downloads, Desktop). Loading this module may be associated with applications that can interact with scheduled tasks via the Windows task scheduler component. Investigation should focus on the loading process and its behavior to determine whether the DLL load is expected (e.g., during an installer) or indicative of abuse. Telemetry required includes image/DLL load events with the loaded DLL name and the image path that performed the load.
references:
- https://www.logpoint.com/en/blog/shenanigans-of-scheduled-tasks/
- https://x.com/Max_Mal_/status/1826179497084739829
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_dll_taskschd_by_process_in_potentially_suspicious_location.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-09-02
tags:
- attack.persistence
- attack.execution
- attack.privilege-escalation
- attack.t1053.005
- detection.threat-hunting
logsource:
category: image_load
product: windows
detection:
selection_dll:
- ImageLoaded|endswith: \taskschd.dll
- OriginalFileName: taskschd.dll
selection_paths:
Image|contains:
- :\Temp\
- :\Users\Public\
- :\Windows\Temp\
- \AppData\Local\Temp\
- \Desktop\
- \Downloads\
condition: all of selection_*
falsepositives:
- Some installers might generate false positives, apply additional filters accordingly.
level: low
license: DRL-1.1
related:
- id: 3b92a1d0-8d4b-4d28-a1b4-1e29d49a6a3e
type: derived