Suspicious Scheduled Task Write to System32 Tasks — Detection Rule

Detects the creation of tasks from processes executed from suspicious locations

Read the full analysis on IntelFusions