Windows schtasks Creates Registry-Backed Base64 PowerShell Payload via Encoded Command

title: Windows schtasks Creates Registry-Backed Base64 PowerShell Payload via Encoded Command
id: de9ec72a-d802-4bd6-9214-1de95bb7d88d
status: test
description: This rule matches Windows process creation where schtasks.exe is used with the /Create option to schedule a command that launches PowerShell. The command line includes indicators of base64 decoding (FromBase64String) and retrieval of data from Windows Registry hives such as HKCU/HKLM, suggesting an encoded payload is stored and executed. It relies on process creation telemetry, specifically the Image filename and PowerShell-containing command-line substrings.
references:
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_reg_loader_encoded.yml
author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport, X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-02-12
modified: 2023-02-04
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
  - attack.t1059.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_cli_create:
    CommandLine|contains: /Create
  selection_cli_encoding:
    CommandLine|contains:
      - FromBase64String
      - encodedcommand
  selection_cli_get:
    CommandLine|contains:
      - Get-ItemProperty
      - " gp "
  selection_cli_hive:
    CommandLine|contains:
      - "HKCU:"
      - "HKLM:"
      - "registry::"
      - HKEY_
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78
    type: derived