title: Suspicious Schtasks Execution AppData Folder
id: c5c00f49-b3f9-45a6-997e-cfdecc6e1967
status: experimental
description: 'Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local'
author: 'pH-T'
references: 
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
date: 2022/03/15
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:
      - '/Create'
      - '/RU "NT AUT'
      - '/TR'
      - 'C:\Users\'
      - '\AppData\Local\'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.execution
  - attack.persistence
  - attack.t1053.005
  - attack.t1059.001
