Scheduled Task Executed From A Suspicious Location

Title: Scheduled Task Executed From A Suspicious Location
Status: test
Description:Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task
References:
  -Internal Research
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-05
modified:2023-02-07
Tags:

• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.persistence'
• -'attack.t1053.005'

Logsource:

• product: windows
• service: taskscheduler
• definition: Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger

Detection:
  selection:
    EventID: '129'
    Path|contains:
      -'C:\Windows\Temp\'
      -'\AppData\Local\Temp\'
      -'\Desktop\'
      -'\Downloads\'
      -'\Users\Public\'
      -'C:\Temp\'

  condition:selection
Falsepositives:
  -Unknown
Level: medium