Suspicious Scheduled Task Write to System32 Tasks

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•17

Detects the creation of scheduled tasks in the `C:\Windows\System32\Tasks` directory by processes originating from suspicious locations such as user `AppData` folders, `C:\PerfLogs`, or `C:\Windows\System32\config\systemprofile`. This activity can indicate persistence or privilege escalation attempts by malware or adversaries.