Windows Scheduled Task Creation Triggered Once at 00:00 Using Scripted Commands
Alerts on suspicious schtasks.exe task creation for a one-time 00:00 run with embedded script/command execution strings.
- Product
- windows
- Category
- process_creation
- Author
- pH-T (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-15
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events involving schtasks.exe where the command line schedules a task to run once at 00:00 and includes scripting or command execution components (e.g., wscript/vbscript/cscript, wmic, regsvr32, powershell, or execution paths under AppData). Attackers may use scheduled tasks for persistence and execution at predictable times, and the “once at 00:00” pattern helps narrow suspicious task creation. It relies on Windows process creation telemetry, matching schtasks.exe plus specific command-line substrings and the required time and scheduling keywords.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Scheduled Task Creation Triggered Once at 00:00 Using Scripted Commands
id: 6615306f-b7b3-424e-bf92-4e1be9b36b98
status: test
description: This rule flags Windows process creation events involving schtasks.exe where the command line schedules a task to run once at 00:00 and includes scripting or command execution components (e.g., wscript/vbscript/cscript, wmic, regsvr32, powershell, or execution paths under AppData). Attackers may use scheduled tasks for persistence and execution at predictable times, and the “once at 00:00” pattern helps narrow suspicious task creation. It relies on Windows process creation telemetry, matching schtasks.exe plus specific command-line substrings and the required time and scheduling keywords.
references:
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_one_time_only_midnight_task.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2022-07-15
modified: 2023-02-03
tags:
- attack.execution
- attack.persistence
- attack.privilege-escalation
- attack.t1053.005
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|contains: \schtasks.exe
- OriginalFileName: schtasks.exe
selection_cli:
CommandLine|contains:
- wscript
- vbscript
- cscript
- "wmic "
- wmic.exe
- regsvr32.exe
- powershell
- \AppData\
selection_time:
CommandLine|contains|all:
- once
- 00:00
condition: all of selection_*
falsepositives:
- Software installation
level: high
license: DRL-1.1
related:
- id: 970823b7-273b-460a-8afc-3a6811998529
type: derived