Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators
Alerts on schtasks.exe task creation commands that simultaneously include curl download indicators and PowerShell execution.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-02-05
- Updated
- 2026-07-30
ATT&CK techniques
Execution → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process creation where schtasks.exe is invoked with task creation arguments, and the same command line also includes curl download activity and PowerShell usage. Attackers may use scheduled tasks to establish persistence while staging or triggering payloads through common scripting and download tools. The detection relies on process creation telemetry, specifically the Image path ending with schtasks.exe and substring matches for /create, curl, http, -o, and powershell in the command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators
id: 1a550ef2-945f-4b25-97e7-33c9e61cb046
status: experimental
description: This rule flags Windows process creation where schtasks.exe is invoked with task creation arguments, and the same command line also includes curl download activity and PowerShell usage. Attackers may use scheduled tasks to establish persistence while staging or triggering payloads through common scripting and download tools. The detection relies on process creation telemetry, specifically the Image path ending with schtasks.exe and substring matches for /create, curl, http, -o, and powershell in the command line.
references:
- https://tria.ge/241015-l98snsyeje/behavioral2
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_curl_and_powershell_combo.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-02-05
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.stealth
- attack.t1053.005
- attack.t1218
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \schtasks.exe
CommandLine|contains|windash: " /create "
selection_curl:
CommandLine|contains|all:
- "curl "
- http
- -o
selection_powershell:
CommandLine|contains: powershell
condition: all of selection_*
falsepositives:
- Legitimate use of schtasks for administrative purposes.
- Automation scripts combining curl and PowerShell in controlled environments.
level: medium
license: DRL-1.1
related:
- id: 1d174d38-8fda-4081-a9b6-56d9763c0cd8
type: derived