huntrule

Windows Scheduled Task Creation Using System Process Names

Flags schtasks.exe /create commands whose arguments reference common Windows system process names.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-02-05
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows process creation events where schtasks.exe is used with the /create option and the command line includes names of common system processes. Attackers can abuse scheduled tasks to run payloads under trusted-looking process names to establish persistence or improve stealth. It relies on process creation telemetry, including the executable name and the full command line string.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Malicious StyleSmuggler (CVE-2026-75650) Post-Exploitation Implant Process (via process_creation)
Masquerading Scheduled Task Masquerading as Windows Defender via Typosquatted Name (via process_creation)
Suspicious Scheduled Task Masquerading As System Process
Malicious Scheduled Task Masquerading as Google Updater via Schtasks
Suspicious Scheduled Task SystemSoundsService2 Creation via Process Creation
Suspicious WinSvcUpd Scheduled Task Persistence via schtasks (via process_creation)
Windows Scheduled Task Creation with Schtasks -XML Using Non-.xml File
Windows Security: checkadmin.exe TargetUserName starting with Administr (Event ID 4799)
Suspicious WARP PANDA BRICKSTORM Backdoor Masquerading as vCenter Process (via process_creation)
Windows Scheduled Task Creation Using System Process Names
Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.