
title: Suspicious Scheduled Task Writ to System32 Tasks
author: Florian Roth
date: 2021/11/16
description:
detection:
  SELECTION_1:
    EventID: 11
  SELECTION_2:
    TargetFilename: '*\Windows\System32\Tasks*'
  SELECTION_3:
    Image:
    - '*\AppData\\*'
    - '*C:\PerfLogs*'
    - '*\Windows\System32\config\systemprofile*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- Unknown
id: 80e1f67a-4596-4351-98f5-a9c3efabac95
level: high
logsource:
  category: file_event
  product: windows
references:
- https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/
status: experimental
tags:
- attack.persistence
- attack.execution
- attack.t1053
ruletype: SIGMA
