Windows Process Creation: Renamed jusched.exe Execution via Java Scheduler Names
Alerts when Java Update Scheduler descriptions are used to execute a process ending with \jusched.exe on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Markus Neis, Swisscom (SigmaHQ), DRL 1.1
- Published
- 2019-06-04
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the process description matches Java Update Scheduler variants, but the executable name ends with \jusched.exe. Attackers may rename or masquerade legitimate-sounding binaries to blend in with expected system activity. The detection relies on Windows process creation telemetry, matching the Description field and enforcing an executable path suffix of \jusched.exe while excluding a specific image filter.
Reporting behind it
- bitdefender.comhttps://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_jusched.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Renamed jusched.exe Execution via Java Scheduler Names"
id: 1f116461-97dc-4e23-b866-004ddb4aa85c
status: test
description: This rule flags Windows process creation events where the process description matches Java Update Scheduler variants, but the executable name ends with \jusched.exe. Attackers may rename or masquerade legitimate-sounding binaries to blend in with expected system activity. The detection relies on Windows process creation telemetry, matching the Description field and enforcing an executable path suffix of \jusched.exe while excluding a specific image filter.
references:
- https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_jusched.yml
author: Markus Neis, Swisscom, Huntrule Team
date: 2019-06-04
modified: 2023-02-03
tags:
- attack.execution
- attack.stealth
- attack.t1036.003
logsource:
category: process_creation
product: windows
detection:
selection:
Description:
- Java Update Scheduler
- Java(TM) Update Scheduler
filter:
Image|endswith: \jusched.exe
condition: selection and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: edd8a48c-1b9f-4ba1-83aa-490338cd1ccb
type: derived