Windows Scheduled Task Backdoor Execution via cmd.exe or PowerShell (System EventID /create /delete)
Flags cmd.exe/powershell.exe command lines that create a System/EventID-based scheduled task to run a payload.
- Product
- windows
- Category
- process_creation
- Author
- @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2022-03-21
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Identifies post-exploitation attempts to execute a payload by creating and immediately deleting a scheduled task using cmd.exe or PowerShell. The matched command line contains elements consistent with crafting a trigger tied to a fictitious Windows event (System/EventID=) and using schtasks-style flags (/create, /delete, /ec, /so, /tn run). This matters because such task creation can provide persistence and deferred execution while blending into legitimate scheduler workflows. The detection relies on Windows process creation telemetry capturing the executing image path (cmd.exe or PowerShell) and the full command line string.
Reporting behind it
- proofpoint.comhttps://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Serpent-Backdoor/proc_creation_win_malware_serpent_backdoor_payload_execution.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Scheduled Task Backdoor Execution via cmd.exe or PowerShell (System EventID /create /delete)
id: f81f3ca0-df4c-4cf8-9430-bd19552aac5b
status: test
description: Identifies post-exploitation attempts to execute a payload by creating and immediately deleting a scheduled task using cmd.exe or PowerShell. The matched command line contains elements consistent with crafting a trigger tied to a fictitious Windows event (System/EventID=) and using schtasks-style flags (/create, /delete, /ec, /so, /tn run). This matters because such task creation can provide persistence and deferred execution while blending into legitimate scheduler workflows. The detection relies on Windows process creation telemetry capturing the executing image path (cmd.exe or PowerShell) and the full command line string.
references:
- https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Serpent-Backdoor/proc_creation_win_malware_serpent_backdoor_payload_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2022-03-21
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.t1053.005
- attack.t1059.006
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \cmd.exe
- \powershell.exe
CommandLine|contains|all:
- "[System/EventID="
- /create
- /delete
- /ec
- /so
- /tn run
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: d5eb7432-fda4-4bba-a37f-ffa74d9ed639
type: derived