MediumSigmaHQ Nasreddine Bencherchali (Nextron Systems)

Scheduled Task Executed Uncommon LOLBIN

Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task

Detection logic

Detection requirements

Platform: Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: windows
Log source service: taskscheduler

Known benign triggers

False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule

Detection rules

Scheduled Task Executed Uncommon LOLBIN

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules