Scheduled Task Creation From Environment Variable Or Suspicious Path Via Schtasks.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•18

Detects the creation of scheduled tasks using 'schtasks.exe' where the task's executable path points to suspicious folders or uses environment variables commonly abused by malware for persistence or privilege escalation. This rule specifically looks for tasks created in locations like 'Perflogs', 'Users\All Users', 'Users\Default', 'Users\Public', 'Windows\Temp', 'AppData\Local', 'AppData\Roaming', or using '%AppData%' and '%Public%' environment variables.