Windows schtasks.exe Scheduled Task Creation by Non-Microsoft Office Integration

title: Windows schtasks.exe Scheduled Task Creation by Non-Microsoft Office Integration
id: a78181ca-0456-4db5-8df1-8e6dbe8df7c9
status: test
description: This rule flags process creation where schtasks.exe is invoked with the /create argument, indicating scheduled task creation. Attackers commonly use scheduled tasks for persistence and can leverage them for privilege escalation by executing commands at specific times. It relies on Windows process creation telemetry, matching the executable path/name and required command-line fragments, while excluding events tied to the Office integration tasks to reduce noise.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_creation.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-01-16
modified: 2025-10-22
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.005
  - attack.s0111
  - car.2013-08-001
  - stp.1u
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \schtasks.exe
    CommandLine|contains: " /create "
  filter_main_system_user:
    User|contains:
      - AUTHORI
      - AUTORI
  filter_optional_msoffice:
    ParentImage:
      - C:\Program Files\Microsoft Office\root\integration\integrator.exe
      - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe
    Image:
      - C:\Windows\System32\schtasks.exe
      - C:\Windows\SysWOW64\schtasks.exe
    CommandLine|contains: Microsoft\Office\Office Performance Monitor
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Administrative activity
  - Software installation
level: low
license: DRL-1.1
related:
  - id: 92626ddd-662c-49e3-ac59-f6535f12d189
    type: derived