Suspicious Scheduled Task Write to System32 Tasks

Title: Suspicious Scheduled Task Write to System32 Tasks
Status: test
Description:Detects the creation of tasks from processes executed from suspicious locations
References:
  -Internal Research
Author: Florian Roth (Nextron Systems)
Date: 2021-11-16
modified:2022-01-12
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.t1053'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    TargetFilename|contains: '\Windows\System32\Tasks'
    Image|contains:
      -'\AppData\'
      -'C:\PerfLogs'
      -'\Windows\System32\config\systemprofile'

  condition:selection
Falsepositives:
  -Unknown
Level: high