Windows Scheduled Task Creation via schtasks with Suspicious Command-Line Patterns

Flags schtasks.exe /Create commands containing suspicious interpreter, encoding, hidden execution, or unusual path/script components.

FreeUnreviewedSigmahighv1

windows-scheduled-task-creation-via-schtasks-with-suspicious-command-line-patter-f2c64357

title: Windows Scheduled Task Creation via schtasks with Suspicious Command-Line Patterns
id: 40d21434-84f2-4e25-a598-8c0d9e9f705d
status: test
description: This rule identifies Windows process executions of schtasks.exe used to create new scheduled tasks with command lines containing suspicious or uncommon execution patterns. Attackers commonly leverage scheduled tasks for persistence or to run additional commands, often by chaining interpreters (cmd/cmd.exe) or command execution frameworks and using hidden or encoded payload delivery indicators. The detection relies on Windows process creation telemetry, matching on the process image ending with \schtasks.exe and specific substrings within the CommandLine field.
references:
  - https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/
  - https://twitter.com/RedDrip7/status/1506480588827467785
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_susp_pattern.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-23
modified: 2024-03-19
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1053.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_schtasks:
    Image|endswith: \schtasks.exe
    CommandLine|contains: "/Create "
  selection_pattern_1:
    CommandLine|contains:
      - "/sc minute "
      - "/ru system "
  selection_pattern_2:
    CommandLine|contains:
      - cmd /c
      - cmd /k
      - cmd /r
      - "cmd.exe /c "
      - "cmd.exe /k "
      - "cmd.exe /r "
  selection_uncommon:
    CommandLine|contains:
      - " -decode "
      - " -enc "
      - " -w hidden "
      - " bypass "
      - " IEX"
      - .DownloadData
      - .DownloadFile
      - .DownloadString
      - "/c start /min "
      - FromBase64String
      - mshta http
      - mshta.exe http
  selection_anomaly_1:
    CommandLine|contains:
      - :\ProgramData\
      - :\Temp\
      - :\Tmp\
      - :\Users\Public\
      - :\Windows\Temp\
      - \AppData\
      - "%AppData%"
      - "%Temp%"
      - "%tmp%"
  selection_anomaly_2:
    CommandLine|contains:
      - cscript
      - curl
      - wscript
  condition: selection_schtasks and ( all of selection_pattern_* or selection_uncommon or all of selection_anomaly_* )
falsepositives:
  - Software installers that run from temporary folders and also install scheduled tasks are expected to generate some false positives
level: high
license: DRL-1.1
related:
  - id: f2c64357-b1d2-41b7-849f-34d2682c0fad
    type: derived

What it detects

This rule identifies Windows process executions of schtasks.exe used to create new scheduled tasks with command lines containing suspicious or uncommon execution patterns. Attackers commonly leverage scheduled tasks for persistence or to run additional commands, often by chaining interpreters (cmd/cmd.exe) or command execution frameworks and using hidden or encoded payload delivery indicators. The detection relies on Windows process creation telemetry, matching on the process image ending with \schtasks.exe and specific substrings within the CommandLine field.

Known false positives

Software installers that run from temporary folders and also install scheduled tasks are expected to generate some false positives

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.