Windows Scheduled Task Creation Using System Process Names

title: Windows Scheduled Task Creation Using System Process Names
id: 12d0f1c1-427f-42ca-acfe-ccb3d630dfb3
status: experimental
description: This rule identifies Windows process creation events where schtasks.exe is used with the /create option and the command line includes names of common system processes. Attackers can abuse scheduled tasks to run payloads under trusted-looking process names to establish persistence or improve stealth. It relies on process creation telemetry, including the executable name and the full command line string.
references:
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_system_process.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-02-05
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.stealth
  - attack.t1053.005
  - attack.t1036.004
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_cli:
    CommandLine|contains|windash: " /create "
    CommandLine|contains:
      - " audiodg"
      - " conhost"
      - " dwm.exe"
      - " explorer"
      - " lsass"
      - " lsm"
      - " mmc"
      - " msiexec"
      - " regsvr32"
      - " rundll32"
      - " services"
      - " spoolsv"
      - " svchost"
      - " taskeng"
      - " taskhost"
      - " wininit"
      - " winlogon"
  condition: all of selection_*
falsepositives:
  - Legitimate system administration tasks scheduling trusted system processes.
level: high
license: DRL-1.1
related:
  - id: 9f8573c9-22b4-40e3-89c1-72bc2b8d49ab
    type: derived