Windows Scheduled Task execution of uncommon binaries via TaskScheduler

Alerts when a Windows Scheduled Task runs a process from a set of uncommon/suspicious binary paths.

FreeUnreviewedSigmamediumv1

windows-scheduled-task-execution-of-uncommon-binaries-via-taskscheduler-f0767f15

title: Windows Scheduled Task execution of uncommon binaries via TaskScheduler
id: 76ff2ec4-b5f6-4c23-9e25-6ca5d3b31fde
status: test
description: This rule flags Scheduled Task process creation events where the executed program path ends with specific uncommon binaries (e.g., calc.exe, cscript.exe, mshta.exe, regsvr32.exe, wscript.exe, etc.). Attackers commonly abuse Scheduled Tasks to achieve persistence or code execution by running living-off-the-land style tools from task scheduler. It relies on Microsoft-Windows-TaskScheduler Operational events (EventID 129) and the process image path reported in the task execution telemetry.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-05
modified: 2023-02-07
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  service: taskscheduler
  definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
  selection:
    EventID: 129
    Path|endswith:
      - \calc.exe
      - \cscript.exe
      - \mshta.exe
      - \mspaint.exe
      - \notepad.exe
      - \regsvr32.exe
      - \wscript.exe
  condition: selection
falsepositives:
  - False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule
level: medium
license: DRL-1.1
related:
  - id: f0767f15-0fb3-44b9-851e-e8d9a6d0005d
    type: derived

What it detects

This rule flags Scheduled Task process creation events where the executed program path ends with specific uncommon binaries (e.g., calc.exe, cscript.exe, mshta.exe, regsvr32.exe, wscript.exe, etc.). Attackers commonly abuse Scheduled Tasks to achieve persistence or code execution by running living-off-the-land style tools from task scheduler. It relies on Microsoft-Windows-TaskScheduler Operational events (EventID 129) and the process image path reported in the task execution telemetry.

Known false positives

False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.