Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators

title: Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators
id: 1a550ef2-945f-4b25-97e7-33c9e61cb046
status: experimental
description: This rule flags Windows process creation where schtasks.exe is invoked with task creation arguments, and the same command line also includes curl download activity and PowerShell usage. Attackers may use scheduled tasks to establish persistence while staging or triggering payloads through common scripting and download tools. The detection relies on process creation telemetry, specifically the Image path ending with schtasks.exe and substring matches for /create, curl, http, -o, and powershell in the command line.
references:
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_curl_and_powershell_combo.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-02-05
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.stealth
  - attack.t1053.005
  - attack.t1218
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \schtasks.exe
    CommandLine|contains|windash: " /create "
  selection_curl:
    CommandLine|contains|all:
      - "curl "
      - http
      - -o
  selection_powershell:
    CommandLine|contains: powershell
  condition: all of selection_*
falsepositives:
  - Legitimate use of schtasks for administrative purposes.
  - Automation scripts combining curl and PowerShell in controlled environments.
level: medium
license: DRL-1.1
related:
  - id: 1d174d38-8fda-4081-a9b6-56d9763c0cd8
    type: derived