huntrule

Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload

Flags schtasks.exe /Create scheduled tasks that launch PowerShell decoding and executing a base64 payload retrieved from Windows Registry.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-07-18
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies process executions where schtasks.exe is invoked with /Create to establish a scheduled task that runs PowerShell. The command line is further constrained to include registry access (e.g., HKCU/HKLM/registry hives) and PowerShell execution patterns that decode base64 content (FromBase64String), indicating a payload sourced from the Windows Registry. It relies on Windows process creation telemetry, specifically schtasks.exe command-line content and related PowerShell and registry indicators.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)
Scheduled Task Creating Per-Minute Hidden PowerShell Execution
Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags
Windows schtasks.exe Create Executes File from AppData\Local
Windows schtasks Creates Registry-Backed Base64 PowerShell Payload via Encoded Command
Windows ChromeLoader Execution via Scheduled Task and Hidden PowerShell Launch
Windows process command lines matching May 2020 Turla ComRAT command patterns
Windows Security: checkadmin.exe TargetUserName starting with Administr (Event ID 4799)
Windows Scheduled Task Creation via PowerShell Using schtasks.exe with ONLOGON/DAILY/ONIDLE/HOURLY
Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload
Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.