Zamanlanmış Görevler ile Kalıcılık ve Lateral Hareket: Teknik Analizi

title: Suspicious Scheduled Task Creation via Temp or AppData Path
id: a7c3e8f2-1b4d-4e9a-b0f5-6d2c8a3e7f91
status: experimental
description: |
  Detects scheduled task creation (EID 4698) where the task action references
  temporary or user-writable directories (Temp, AppData, Public, Downloads).
  Adversaries frequently schedule tasks pointing to dropped payloads in these
  locations for persistence or privilege escalation. AI-generated / unvalidated.
references:
  - https://attack.mitre.org/techniques/T1053/005/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_scheduled_task_creation.yml
  - https://www.elastic.co/guide/en/security/current/local-scheduled-task-commands.html
author: CyberSecLab (AI)
date: 2026-06-13
tags:
  - attack.t1053.005
  - attack.persistence
  - attack.privilege_escalation
logsource:
  product: windows
  service: security
detection:
  selection_eid:
    EventID:
      - 4698
      - 4702
  selection_susp_path:
    TaskContent|contains:
      - '\Temp\'
      - '\AppData\'
      - '\Public\'
      - '\Desktop\'
      - '\Downloads\'
      - '\ProgramData\'
      - '\Users\Public\'
  selection_susp_cmd:
    TaskContent|contains:
      - 'powershell'
      - 'cmd.exe'
      - 'regsvr32'
      - 'rundll32'
      - 'certutil'
      - 'bitsadmin'
      - 'mshta'
      - 'wscript'
      - 'cscript'
      - 'wmic'
  condition: selection_eid and (selection_susp_path or selection_susp_cmd)
falsepositives:
  - Legitimate software installers creating tasks with PowerShell actions
  - Enterprise management tools (SCCM, Ansible) deploying tasks pointing to staging paths
  - Developer tooling during application setup
level: high