PowerShell and Empire schtasks.exe Task Creation via schtasks /Create with /TN Updater /TR

title: PowerShell and Empire schtasks.exe Task Creation via schtasks /Create with /TN Updater /TR
id: c257d485-bae4-4036-93b0-77d91caa5dad
status: test
description: This rule identifies Windows process executions where PowerShell (powershell.exe or pwsh.exe) launches schtasks.exe with task creation parameters consistent with default PowerSploit/Empire persistence behavior. Attackers use scheduled tasks to regain execution after reboot or user activity, making task creation a high-signal persistence step. The rule relies on Windows process creation telemetry, specifically parent/child process image paths and schtasks command-line arguments such as /Create and the /TN Updater /TR pattern.
references:
  - https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1
  - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_powersploit_empire_default_schtasks.yml
author: Markus Neis, @Karneades, Huntrule Team
date: 2018-03-06
modified: 2023-03-03
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.s0111
  - attack.g0022
  - attack.g0060
  - car.2013-08-001
  - attack.t1053.005
  - attack.t1059.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - \powershell.exe
      - \pwsh.exe
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
      - /Create
      - powershell.exe -NonI
      - /TN Updater /TR
    CommandLine|contains:
      - /SC ONLOGON
      - /SC DAILY /ST
      - /SC ONIDLE
      - /SC HOURLY
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 56c217c3-2de2-479b-990f-5c109ba8458f
    type: derived