Windows Process Creation: Scheduled Task Persistence via schtasks Create and VBScript

title: "Windows Process Creation: Scheduled Task Persistence via schtasks Create and VBScript"
id: 2454efba-c212-41b9-8468-dd1157c2f54f
status: test
description: This rule flags Windows process creation events where the command line contains the components of scheduled task creation using schtasks, along with a wscript execution of a VBScript engine parameter. Attackers can use scheduled tasks to establish persistence that runs automatically under controlled conditions. The detection relies on process command-line telemetry to match the specific combination of schtasks create and wscript /e:vbscript parameters.
references:
  - https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/TA/ACTINIUM/proc_creation_win_apt_actinium_persistence.yml
author: Andreas Hunkeler (@Karneades), Huntrule Team
date: 2022-02-07
modified: 2023-03-18
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053
  - attack.t1053.005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - schtasks
      - create
      - wscript
      - " /e:vbscript"
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e1118a8f-82f5-44b3-bb6b-8a284e5df602
    type: derived