Windows Scheduled Task Creation Triggered Once at 00:00 Using Scripted Commands

title: Windows Scheduled Task Creation Triggered Once at 00:00 Using Scripted Commands
id: 6615306f-b7b3-424e-bf92-4e1be9b36b98
status: test
description: This rule flags Windows process creation events involving schtasks.exe where the command line schedules a task to run once at 00:00 and includes scripting or command execution components (e.g., wscript/vbscript/cscript, wmic, regsvr32, powershell, or execution paths under AppData). Attackers may use scheduled tasks for persistence and execution at predictable times, and the “once at 00:00” pattern helps narrow suspicious task creation. It relies on Windows process creation telemetry, matching schtasks.exe plus specific command-line substrings and the required time and scheduling keywords.
references:
  - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_one_time_only_midnight_task.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2022-07-15
modified: 2023-02-03
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|contains: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_cli:
    CommandLine|contains:
      - wscript
      - vbscript
      - cscript
      - "wmic "
      - wmic.exe
      - regsvr32.exe
      - powershell
      - \AppData\
  selection_time:
    CommandLine|contains|all:
      - once
      - 00:00
  condition: all of selection_*
falsepositives:
  - Software installation
level: high
license: DRL-1.1
related:
  - id: 970823b7-273b-460a-8afc-3a6811998529
    type: derived