Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload

title: "Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload"
id: 53379925-97a2-43d6-9f49-111af9870e44
related:
  - id: c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78
    type: derived
  - id: 86588b36-c6d3-465f-9cee-8f9093e07798
    type: derived
status: test
description: This rule identifies process executions where schtasks.exe is invoked with /Create to establish a scheduled task that runs PowerShell. The command line is further constrained to include registry access (e.g., HKCU/HKLM/registry hives) and PowerShell execution patterns that decode base64 content (FromBase64String), indicating a payload sourced from the Windows Registry. It relies on Windows process creation telemetry, specifically schtasks.exe command-line content and related PowerShell and registry indicators.
references:
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_reg_loader.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-18
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
  - attack.t1059.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_cli_create:
    CommandLine|contains: /Create
  selection_cli_get:
    CommandLine|contains:
      - Get-ItemProperty
      - " gp "
  selection_cli_hive:
    CommandLine|contains:
      - "HKCU:"
      - "HKLM:"
      - "registry::"
      - HKEY_
  filter_main_encoding:
    CommandLine|contains:
      - FromBase64String
      - encodedcommand
  condition: all of selection_* and not 1 of filter_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1