huntrule

Windows schtasks.exe Create Executes File from AppData\Local

Alerts on schtasks.exe creating tasks that run payloads from C:\Users\<user>\AppData\Local.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-03-15
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions of schtasks.exe that create a scheduled task to run an executable located under a user’s AppData\Local path. Attackers commonly use Task Scheduler for persistence and execution by placing payloads in per-user application data directories and then scheduling them to run under a high-privilege account. It relies on Windows process creation telemetry, matching schtasks.exe command-line arguments that include /Create, /RU, /TR, and an AppData\Local target.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)
Scheduled Task Creating Per-Minute Hidden PowerShell Execution
Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload
Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags
Windows schtasks Creates Registry-Backed Base64 PowerShell Payload via Encoded Command
Windows ChromeLoader Execution via Scheduled Task and Hidden PowerShell Launch
Windows process command lines matching May 2020 Turla ComRAT command patterns
Windows Security: checkadmin.exe TargetUserName starting with Administr (Event ID 4799)
Windows Scheduled Task Creation via PowerShell Using schtasks.exe with ONLOGON/DAILY/ONIDLE/HOURLY
Windows schtasks.exe Create Executes File from AppData\Local
Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.