Windows schtasks.exe Creating One-Time Scheduled Tasks Using Temp Folder

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1053.005Scheduled Task
Persistence
- T1053.005Scheduled Task
Priv Esc
- T1053.005Scheduled Task
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where schtasks.exe is used with arguments to create a scheduled task that runs once and references a Temp folder path. Attackers often use scheduled tasks for persistence or to stage execution from temporary locations to avoid drawing attention. The detection relies on process creation telemetry, matching schtasks.exe command-line parameters including the one-time schedule and a \Temp\ path.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange

Suspicious Scheduled Task Named WindowsHelper (via process_creation)

Scheduled Task Masquerading as Microsoft Wininet Config

Suspicious SYSTEM Scheduled Task Named test Created via schtasks

Suspicious Scheduled Task Created by Windows Script Host

Malicious CloudZ RAT Persistence via schtasks Running regasm.exe

Suspicious Scheduled Task Creation for WSPrint Persistence by UAT-9244

Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell

Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware

Malicious Scheduled Task Masquerading as Edge Update Running From Temp (via process_creation)

Windows schtasks.exe Creating One-Time Scheduled Tasks Using Temp Folder

Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-schtasks-exe-creating-one-time-scheduled-tasks-using-temp-folder-39019a4e

title: Windows schtasks.exe Creating One-Time Scheduled Tasks Using Temp Folder
id: e588d1d8-f77b-4b6b-a80b-a6e8779d4374
status: test
description: This rule flags Windows process creation events where schtasks.exe is used with arguments to create a scheduled task that runs once and references a Temp folder path. Attackers often use scheduled tasks for persistence or to stage execution from temporary locations to avoid drawing attention. The detection relies on process creation telemetry, matching schtasks.exe command-line parameters including the one-time schedule and a \Temp\ path.
references:
  - https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_creation_temp_folder.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-03-11
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
      - " /create "
      - " /sc once "
      - \Temp\
  condition: selection
falsepositives:
  - Administrative activity
  - Software installation
level: high
license: DRL-1.1
related:
  - id: 39019a4e-317f-4ce3-ae63-309a8c6b53c5
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL