Windows Scheduled Task Creation with GUID-like Task Name
Alerts on schtasks.exe creating scheduled tasks whose /TN value is wrapped GUID-like braces.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-31
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of schtasks.exe that create a new scheduled task (/Create) with a task name formatted like a GUID (enclosed in braces within the /TN argument). GUID-like task names are commonly used to make persistence artifacts look generic and harder to distinguish from legitimate tasks. The detection relies on Windows process creation telemetry, specifically the Image ending in schtasks.exe and the contents of the CommandLine around the /Create and /TN parameters.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
- thedfirreport.comhttps://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_guid_task_name.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Scheduled Task Creation with GUID-like Task Name
id: fb590dcf-5554-4466-bb9c-b26e2cb29185
status: test
description: This rule flags process executions of schtasks.exe that create a new scheduled task (/Create) with a task name formatted like a GUID (enclosed in braces within the /TN argument). GUID-like task names are commonly used to make persistence artifacts look generic and harder to distinguish from legitimate tasks. The detection relies on Windows process creation telemetry, specifically the Image ending in schtasks.exe and the contents of the CommandLine around the /Create and /TN parameters.
references:
- https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_guid_task_name.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-31
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.t1053.005
logsource:
product: windows
category: process_creation
detection:
selection_img:
Image|endswith: \schtasks.exe
CommandLine|contains: "/Create "
selection_tn:
CommandLine|contains:
- /TN "{
- /TN '{
- /TN {
selection_end:
CommandLine|contains:
- '}"'
- "}'"
- "} "
condition: all of selection_*
falsepositives:
- Legitimate software naming their tasks as GUIDs
level: medium
license: DRL-1.1
related:
- id: ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b
type: derived