Windows schtasks.exe Create Executes File from AppData\Local

title: Windows schtasks.exe Create Executes File from AppData\Local
id: 547305eb-c975-4de7-8f6b-39a1a3fd1fe1
status: test
description: This rule flags process executions of schtasks.exe that create a scheduled task to run an executable located under a user’s AppData\Local path. Attackers commonly use Task Scheduler for persistence and execution by placing payloads in per-user application data directories and then scheduling them to run under a high-privilege account. It relies on Windows process creation telemetry, matching schtasks.exe command-line arguments that include /Create, /RU, /TR, and an AppData\Local target.
references:
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_appdata_local_system.yml
author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-03-15
modified: 2022-07-28
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
  - attack.t1059.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
      - /Create
      - /RU
      - /TR
      - C:\Users\
      - \AppData\Local\
    CommandLine|contains:
      - NT AUT
      - " SYSTEM "
  filter:
    ParentImage|contains|all:
      - \AppData\Local\Temp\
      - TeamViewer_.exe
    Image|endswith: \schtasks.exe
    CommandLine|contains: /TN TVInstallRestore
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c5c00f49-b3f9-45a6-997e-cfdecc6e1967
    type: derived