title: Scheduled Task Created To Run From A User-Writable Path
id: 0f880392-aae4-40c3-93a5-41ba717aa563
status: experimental
description: |
  Detects schtasks.exe creating a task whose action points into a directory any user can write
  to. Legitimate installers register tasks that run from Program Files or System32; a task that
  runs from Public, Temp, AppData or ProgramData is either persistence or software worth knowing
  about.
references:
  - https://attack.mitre.org/techniques/T1053/005/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.persistence
  - attack.execution
  - attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\schtasks.exe'
    - OriginalFileName: 'schtasks.exe'
  selection_create:
    CommandLine|contains: '/create'
  selection_path:
    CommandLine|contains:
      - '\Users\Public\'
      - '\AppData\'
      - '\ProgramData\'
      - '\Windows\Temp\'
      - '%TEMP%'
      - '%APPDATA%'
      - '%PUBLIC%'
  condition: all of selection_*
falsepositives:
  - Per-user updaters (browsers, chat clients, Zoom) registering tasks from AppData. Exclude by exact task name and signed binary, not by directory.
level: medium