Windows schtasks.exe Creating One-Time Scheduled Tasks Using Temp Folder

title: Windows schtasks.exe Creating One-Time Scheduled Tasks Using Temp Folder
id: e588d1d8-f77b-4b6b-a80b-a6e8779d4374
status: test
description: This rule flags Windows process creation events where schtasks.exe is used with arguments to create a scheduled task that runs once and references a Temp folder path. Attackers often use scheduled tasks for persistence or to stage execution from temporary locations to avoid drawing attention. The detection relies on process creation telemetry, matching schtasks.exe command-line parameters including the one-time schedule and a \Temp\ path.
references:
  - https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_creation_temp_folder.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-03-11
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
      - " /create "
      - " /sc once "
      - \Temp\
  condition: selection
falsepositives:
  - Administrative activity
  - Software installation
level: high
license: DRL-1.1
related:
  - id: 39019a4e-317f-4ce3-ae63-309a8c6b53c5
    type: derived