Suspicious Scheduled Task Write to System32 Tasks

 1title: Suspicious Scheduled Task Write to System32 Tasks
 2id: 80e1f67a-4596-4351-98f5-a9c3efabac95
 3status: test
 4description: Detects the creation of tasks from processes executed from suspicious locations
 5references:
 6    - Internal Research
 7author: Florian Roth (Nextron Systems)
 8date: 2021/11/16
 9modified: 2022/01/12
10tags:
11    - attack.persistence
12    - attack.execution
13    - attack.t1053
14logsource:
15    product: windows
16    category: file_event
17detection:
18    selection:
19        TargetFilename|contains: '\Windows\System32\Tasks'
20        Image|contains:
21            - '\AppData\'
22            - 'C:\PerfLogs'
23            - '\Windows\System32\config\systemprofile'
24    condition: selection
25falsepositives:
26    - Unknown
27level: high

References

• Internal Research

  
  Read More

Related rules

• Windows Scheduled Task Behaving Improperly or Suspiciously
• Windows Scheduled Task Create Shell
• Windows Scheduled Task Making Suspicious Network Connection
• DLL Load via LSASS
• Suspicious Encoded Scripts in a WMI Consumer