Windows Scheduled Task Backdoor Execution via cmd.exe or PowerShell (System EventID /create /delete)

Flags cmd.exe/powershell.exe command lines that create a System/EventID-based scheduled task to run a payload.

FreeReviewedSigma · High · v5
Product
windows
Category
process_creation
Author
@kostastsale (SigmaHQ), DRL 1.1
Published
2022-03-21
Updated
2026-07-31
title: Windows Scheduled Task Backdoor Execution via cmd.exe or PowerShell (System EventID /create /delete)
id: f81f3ca0-df4c-4cf8-9430-bd19552aac5b
status: test
description: Identifies post-exploitation attempts to execute a payload by creating and immediately deleting a scheduled task using cmd.exe or PowerShell. The matched command line contains elements consistent with crafting a trigger tied to a fictitious Windows event (System/EventID=) and using schtasks-style flags (/create, /delete, /ec, /so, /tn run). This matters because such task creation can provide persistence and deferred execution while blending into legitimate scheduler workflows. The detection relies on Windows process creation telemetry capturing the executing image path (cmd.exe or PowerShell) and the full command line string.
references:
  - https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Serpent-Backdoor/proc_creation_win_malware_serpent_backdoor_payload_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2022-03-21
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
  - attack.t1059.006
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
    CommandLine|contains|all:
      - "[System/EventID="
      - /create
      - /delete
      - /ec
      - /so
      - /tn run
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: d5eb7432-fda4-4bba-a37f-ffa74d9ed639
    type: derived