huntrule

Windows Scheduled Task Creation Using SVR-Specific Task Names

Alerts on Windows scheduled task events with SVR-associated task names indicative of persistence.

FreeReviewedSigma · High · v5
Product
windows
Service
security
Author
CISA (SigmaHQ), DRL 1.1
Published
2023-12-18
Updated
2026-07-31
AnalysisDetection
title: Windows Scheduled Task Creation Using SVR-Specific Task Names
id: a9342a9e-548e-47aa-a09c-a25c630607d6
related:
  - id: 2bfc1373-0220-4fbd-8b10-33ddafd2a142
    type: similar
  - id: 8fa65166-f463-4fd2-ad4f-1436133c52e1
    type: derived
status: test
description: This rule flags Windows security events where scheduled task operations (creation, update, or assignment) reference a set of SVR-specific task names. Attackers may use scheduled tasks to persist or periodically execute malicious components, making these task name patterns useful for early compromise hunting. It relies on Windows Security audit events 4698, 4699, and 4702 with the corresponding TaskName field matching the listed values.
author: CISA, Huntrule Team
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Cozy-Bear/win_security_apt_cozy_bear_scheduled_tasks_name.yml
date: 2023-12-18
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  service: security
  product: windows
detection:
  selection:
    EventID:
      - 4698
      - 4699
      - 4702
    TaskName:
      - \defender
      - \Microsoft\DefenderService
      - \Microsoft\Windows\Application Experience\StartupAppTaskCheck
      - \Microsoft\Windows\Application Experience\StartupAppTaskCkeck
      - \Microsoft\Windows\ATPUpd
      - \Microsoft\Windows\Data Integrity Scan\Data Integrity Update
      - \Microsoft\Windows\DefenderUPDService
      - \Microsoft\Windows\IISUpdateService
      - \Microsoft\Windows\Speech\SpeechModelInstallTask
      - \Microsoft\Windows\WiMSDFS
      - \Microsoft\Windows\Windows Defender\Defender Update Service
      - \Microsoft\Windows\Windows Defender\Service Update
      - \Microsoft\Windows\Windows Error Reporting\CheckReporting
      - \Microsoft\Windows\Windows Error Reporting\SubmitReporting
      - \Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart
      - \Microsoft\Windows\WindowsDefenderService
      - \Microsoft\Windows\WindowsDefenderService2
      - \Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck
      - \Microsoft\Windows\WindowsUpdate\Scheduled Check
      - \WindowUpdate
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1