Windows Scheduled Task Creation with GUID-like Task Name

title: Windows Scheduled Task Creation with GUID-like Task Name
id: fb590dcf-5554-4466-bb9c-b26e2cb29185
status: test
description: This rule flags process executions of schtasks.exe that create a new scheduled task (/Create) with a task name formatted like a GUID (enclosed in braces within the /TN argument). GUID-like task names are commonly used to make persistence artifacts look generic and harder to distinguish from legitimate tasks. The detection relies on Windows process creation telemetry, specifically the Image ending in schtasks.exe and the contents of the CommandLine around the /Create and /TN parameters.
references:
  - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_guid_task_name.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-31
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1053.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    Image|endswith: \schtasks.exe
    CommandLine|contains: "/Create "
  selection_tn:
    CommandLine|contains:
      - /TN "{
      - /TN '{
      - /TN {
  selection_end:
    CommandLine|contains:
      - '}"'
      - "}'"
      - "} "
  condition: all of selection_*
falsepositives:
  - Legitimate software naming their tasks as GUIDs
level: medium
license: DRL-1.1
related:
  - id: ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b
    type: derived