Scheduled Task Executed From A Suspicious Location — Detection Rule

Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task

Read the full analysis on IntelFusions