Windows Task Scheduler DLL Loaded From Uncommon Directory

title: Windows Task Scheduler DLL Loaded From Uncommon Directory
id: 65986d28-6ef3-4f7d-ba3d-e17a1143cca6
status: test
description: This rule flags when taskschd.dll is loaded and the loading image path contains one of several uncommon or potentially suspicious locations (for example Temp, Public, Downloads, Desktop). Loading this module may be associated with applications that can interact with scheduled tasks via the Windows task scheduler component. Investigation should focus on the loading process and its behavior to determine whether the DLL load is expected (e.g., during an installer) or indicative of abuse. Telemetry required includes image/DLL load events with the loaded DLL name and the image path that performed the load.
references:
  - https://www.logpoint.com/en/blog/shenanigans-of-scheduled-tasks/
  - https://x.com/Max_Mal_/status/1826179497084739829
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_dll_taskschd_by_process_in_potentially_suspicious_location.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-09-02
tags:
  - attack.persistence
  - attack.execution
  - attack.privilege-escalation
  - attack.t1053.005
  - detection.threat-hunting
logsource:
  category: image_load
  product: windows
detection:
  selection_dll:
    - ImageLoaded|endswith: \taskschd.dll
    - OriginalFileName: taskschd.dll
  selection_paths:
    Image|contains:
      - :\Temp\
      - :\Users\Public\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
      - \Desktop\
      - \Downloads\
  condition: all of selection_*
falsepositives:
  - Some installers might generate false positives, apply additional filters accordingly.
level: low
license: DRL-1.1
related:
  - id: 3b92a1d0-8d4b-4d28-a1b4-1e29d49a6a3e
    type: derived