Windows Scheduled Task Creation via PowerShell Using schtasks.exe with ONLOGON/DAILY/ONIDLE/HOURLY

Flags PowerShell-launched schtasks.exe /Create commands matching default PowerSploit/Empire scheduled task persistence behavior.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Markus Neis, @Karneades (SigmaHQ), DRL 1.1
Published: 2018-03-06
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1053.005Scheduled Task
- T1059.001PowerShell
Persistence
- T1053.005Scheduled Task
Priv Esc
- T1053.005Scheduled Task
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where PowerShell (powershell.exe/pwsh.exe) launches schtasks.exe to create a scheduled task. It specifically matches a schtasks.exe /Create command targeting the /TN Updater and a /TR that includes a PowerShell non-interactive invocation, along with recurring trigger settings (/SC ONLOGON, /SC DAILY /ST, /SC ONIDLE, or /SC HOURLY). Attackers commonly use scheduled tasks for persistence and to execute payloads automatically, so this behavior is high-signal when seen in process telemetry. The rule relies on Windows process creation fields for ParentImage, Image, and CommandLine.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange

Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)

Scheduled Task Creating Per-Minute Hidden PowerShell Execution

Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload

Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags

Windows schtasks.exe Create Executes File from AppData\Local

Windows schtasks Creates Registry-Backed Base64 PowerShell Payload via Encoded Command

Windows ChromeLoader Execution via Scheduled Task and Hidden PowerShell Launch

Windows process command lines matching May 2020 Turla ComRAT command patterns

Windows Security: checkadmin.exe TargetUserName starting with Administr (Event ID 4799)

Windows Scheduled Task Creation via PowerShell Using schtasks.exe with ONLOGON/DAILY/ONIDLE/HOURLY

Pivot detection · T1053.005 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-and-empire-schtasks-exe-task-creation-via-schtasks-create-with-tn-upd-56c217c3

title: Windows Scheduled Task Creation via PowerShell Using schtasks.exe with ONLOGON/DAILY/ONIDLE/HOURLY
id: c257d485-bae4-4036-93b0-77d91caa5dad
status: test
description: This rule flags process creation events where PowerShell (powershell.exe/pwsh.exe) launches schtasks.exe to create a scheduled task. It specifically matches a schtasks.exe /Create command targeting the /TN Updater and a /TR that includes a PowerShell non-interactive invocation, along with recurring trigger settings (/SC ONLOGON, /SC DAILY /ST, /SC ONIDLE, or /SC HOURLY). Attackers commonly use scheduled tasks for persistence and to execute payloads automatically, so this behavior is high-signal when seen in process telemetry. The rule relies on Windows process creation fields for ParentImage, Image, and CommandLine.
references:
  - https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1
  - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_powersploit_empire_default_schtasks.yml
author: Markus Neis, @Karneades, Huntrule Team
date: 2018-03-06
modified: 2023-03-03
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.s0111
  - attack.g0022
  - attack.g0060
  - car.2013-08-001
  - attack.t1053.005
  - attack.t1059.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - \powershell.exe
      - \pwsh.exe
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
      - /Create
      - powershell.exe -NonI
      - /TN Updater /TR
    CommandLine|contains:
      - /SC ONLOGON
      - /SC DAILY /ST
      - /SC ONIDLE
      - /SC HOURLY
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 56c217c3-2de2-479b-990f-5c109ba8458f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL