Suspicious Schtasks Execution AppData Folder — Detection Rule

Detects the creation of a schtask that executes a file from C:\Users\\AppData\Local

Read the full analysis on IntelFusions