Windows Scheduled Task Creation with Schtasks -XML Using Non-.xml File
Alerts when schtasks.exe creates a scheduled task using -XML but the referenced file does not end with .xml.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel, Elastic (idea) (SigmaHQ), DRL 1.1
- Published
- 2023-04-20
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where schtasks.exe is invoked with /create and the /xml argument, but the command line does not include a .xml file extension. Attackers may use this masquerading technique to hide scheduled task payloads and improve persistence while blending into expected task creation activity. It relies on Windows process creation telemetry, including the executable name, command line arguments, and integrity level and parent process context to reduce likely benign cases.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-
- github.comhttps://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Scheduled Task Creation with Schtasks -XML Using Non-.xml File
id: 312df5ab-de65-44a7-a5b1-e23adcf56b01
status: test
description: This rule flags process creation where schtasks.exe is invoked with /create and the /xml argument, but the command line does not include a .xml file extension. Attackers may use this masquerading technique to hide scheduled task payloads and improve persistence while blending into expected task creation activity. It relies on Windows process creation telemetry, including the executable name, command line arguments, and integrity level and parent process context to reduce likely benign cases.
references:
- https://learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-
- https://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml
author: Swachchhanda Shrawan Poudel, Elastic (idea), Huntrule Team
date: 2023-04-20
modified: 2024-12-01
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.stealth
- attack.t1036.005
- attack.t1053.005
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \schtasks.exe
- OriginalFileName: schtasks.exe
selection_cli_create:
CommandLine|contains:
- /create
- -create
selection_cli_xml:
CommandLine|contains:
- /xml
- -xml
filter_main_extension_xml:
CommandLine|contains: .xml
filter_main_system_process:
IntegrityLevel:
- System
- S-1-16-16384
filter_main_rundll32:
ParentImage|endswith: \rundll32.exe
ParentCommandLine|contains|all:
- :\WINDOWS\Installer\MSI
- .tmp,zzzzInvokeManagedCustomActionOutOfProc
filter_optional_third_party:
ParentImage|endswith:
- :\ProgramData\OEM\UpgradeTool\CareCenter_*\BUnzip\Setup_msi.exe
- :\Program Files\Axis Communications\AXIS Camera Station\SetupActions.exe
- :\Program Files\Axis Communications\AXIS Device Manager\AdmSetupActions.exe
- :\Program Files (x86)\Zemana\AntiMalware\AntiMalware.exe
- :\Program Files\Dell\SupportAssist\pcdrcui.exe
condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c
type: derived