huntrule

Suspicious Per-Minute Scheduled Task Persistence via schtasks

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-21
Updated
2026-09-21
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects schtasks creating a task that runs every minute, the aggressive persistence and re-execution cadence used by Blind Eagle to keep its loader alive. A minute interval schedule is unusual for legitimate software and typically indicates malware ensuring rapid respawn.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Malicious Scheduled Task Masquerading as OneDrive Security Task via Command Line
Suspicious Scheduled Task Running VBScript on Short Recurring Interval via Command Line
Suspicious Scheduled Task Creation Running VBScript for Persistence via Command Line
Suspicious Scheduled Task Under NetFramework Path via PHANTOMPULSE
Suspicious Scheduled Task Updater Creation for Loader Persistence via process_creation
Malicious GHOSTENGINE Scheduled Task Creation Masquerading as Updater via process_creation
Suspicious Scheduled Task Masquerading as Office Update via Process Creation
Suspicious Scheduled Task Creation from XML Definition via Process Creation
Suspicious Scheduled Task Named WindowsHelper (via process_creation)
Suspicious Per-Minute Scheduled Task Persistence via schtasks
Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.