Detection rules › By eventMicrosoft-Windows-TaskScheduler event 1292 detection rules reference this event. View event page.Sigma (2)Scheduled Task Executed From A Suspicious Location severity medium T1053.005 Scheduled Task Executed Uncommon LOLBIN severity medium T1053.005