Windows Scheduled Task Creation via schtasks.exe from Suspicious Parent Paths

title: Windows Scheduled Task Creation via schtasks.exe from Suspicious Parent Paths
id: 02c8c25c-d040-4cca-9d8f-4eb760977e67
status: test
description: This rule identifies process executions where schtasks.exe is run with /Create, and the parent process path is located in common temporary or user-writable directories. Attackers often use scheduled tasks for persistence by spawning task creation commands from these locations to evade simpler monitoring. It relies on Windows process creation telemetry, matching on the parent image path substrings and schtasks.exe invocation details in the command line.
references:
  - https://app.any.run/tasks/649e7b46-9bec-4d05-98a5-dfa9a13eaae5/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_schtasks_creation_from_susp_parent.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-23
modified: 2024-05-13
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.005
  - detection.threat-hunting
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|contains:
      - :\Temp\
      - \AppData\Local\
      - \AppData\Roaming\
      - \Temporary Internet
      - \Users\Public\
      - \Windows\Temp\
    Image|endswith: \schtasks.exe
    CommandLine|contains: "/Create "
  filter_optional_common:
    CommandLine|contains:
      - update_task.xml
      - unattended.ini
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Software installers that run from temporary folders and also install scheduled tasks
level: medium
license: DRL-1.1
related:
  - id: 9494479d-d994-40bf-a8b1-eea890237021
    type: derived