huntrule

Suspicious Scheduled Task Creation Running DLL from ProgramData

PremiumReviewedSigma · High · v1
Category
process_creation
Author
HuntRule
Published
2026-08-02
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects schtasks.exe creating a scheduled task whose action invokes rundll32 against a DLL located in ProgramData, matching the persistence mechanism of the WARMCOOKIE backdoor. Adversaries register such tasks so the loader runs automatically after reboot or logon.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Suspicious Persistence via pcalua Launching rundll32 Control_RunDLL
Suspicious DanaBot Updater Scheduled Task Running Rundll32 from AppData via schtasks
Suspicious Scheduled Task Running rundll32 DllRegisterServer Every Minute
Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)
Agent Tesla Persistence via Realtek Named Scheduled Task Batch
Suspicious Scheduled Task Creation Named test3 by Salt Typhoon
Suspicious MeshAgent Persistence via Scheduled Task MeshUserTask (via process_creation)
Malicious PureMiner Persistence Executable in AppData HResult Folder
Suspicious Kimsuky Scheduled Task Impersonating Google Update CGI (via process_creation)
Suspicious Scheduled Task Creation Running DLL from ProgramData
Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.