Schtasks From Suspicious Folders — Detection Rule

Detects scheduled task creations that have suspicious action command and folder combinations

Read the full analysis on IntelFusions