Windows Scheduled Task Creation with Schtasks -XML Using Non-.xml File

title: Windows Scheduled Task Creation with Schtasks -XML Using Non-.xml File
id: 312df5ab-de65-44a7-a5b1-e23adcf56b01
status: test
description: This rule flags process creation where schtasks.exe is invoked with /create and the /xml argument, but the command line does not include a .xml file extension. Attackers may use this masquerading technique to hide scheduled task payloads and improve persistence while blending into expected task creation activity. It relies on Windows process creation telemetry, including the executable name, command line arguments, and integrity level and parent process context to reduce likely benign cases.
references:
  - https://learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-
  - https://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml
author: Swachchhanda Shrawan Poudel, Elastic (idea), Huntrule Team
date: 2023-04-20
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.stealth
  - attack.t1036.005
  - attack.t1053.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_cli_create:
    CommandLine|contains:
      - /create
      - -create
  selection_cli_xml:
    CommandLine|contains:
      - /xml
      - -xml
  filter_main_extension_xml:
    CommandLine|contains: .xml
  filter_main_system_process:
    IntegrityLevel:
      - System
      - S-1-16-16384
  filter_main_rundll32:
    ParentImage|endswith: \rundll32.exe
    ParentCommandLine|contains|all:
      - :\WINDOWS\Installer\MSI
      - .tmp,zzzzInvokeManagedCustomActionOutOfProc
  filter_optional_third_party:
    ParentImage|endswith:
      - :\ProgramData\OEM\UpgradeTool\CareCenter_*\BUnzip\Setup_msi.exe
      - :\Program Files\Axis Communications\AXIS Camera Station\SetupActions.exe
      - :\Program Files\Axis Communications\AXIS Device Manager\AdmSetupActions.exe
      - :\Program Files (x86)\Zemana\AntiMalware\AntiMalware.exe
      - :\Program Files\Dell\SupportAssist\pcdrcui.exe
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c
    type: derived