high Sigma Windows

Scheduled Task Created From a Suspicious Binary Path

A task registered with an action pointing at a user-writable directory. Legitimate installers schedule from Program Files; attackers schedule from temp.

Rule source

scheduled-task-suspicious-creation.yml

title: Scheduled Task Created From a Suspicious Binary Path
id: 3f9c21ab-5d77-4e0c-9a18-7b46e2c9d015
status: stable
description: >
  Detects schtasks.exe or the Task Scheduler COM interface registering a task
  whose action points at a user-writable directory. Legitimate software installs
  tasks from Program Files or System32; attackers install them from temp.
references:
  - https://attack.mitre.org/techniques/T1053/005/
author: DetectionOps
date: 2026/09/10
logsource:
  product: windows
  service: security
detection:
  selection_task:
    EventID: 4698
  selection_path:
    TaskContent|contains:
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\Windows\Temp\'
      - '\ProgramData\'
      - '\$Recycle.Bin\'
  filter_sccm:
    SubjectUserName|endswith: '$'
    TaskName|startswith: '\Microsoft\Configuration Manager\'
  filter_updater:
    TaskName|startswith:
      - '\Microsoft\Windows\UpdateOrchestrator\'
      - '\Mozilla\'
      - '\GoogleSystem\'
  condition: selection_task and selection_path and not 1 of filter_*
fields:
  - TaskName
  - SubjectUserName
  - TaskContent
falsepositives:
  - Installers that stage from ProgramData - allowlist by task name, not by folder
  - Software updaters running under SYSTEM with vendor-specific task paths
level: high
tags:
  - attack.persistence
  - attack.t1053.005

Required telemetry

Windows Security - Event ID 4698 (task registered)

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Installers that stage from ProgramData - allowlist by task name, never by folder
Vendor updaters running as SYSTEM with their own task subtree

Validation

Atomic Red Team T1053.005-1 and -2, plus a manual schtasks /create from %TEMP%

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.