Windows schtasks.exe Scheduled Task Creation by Non-Microsoft Office Integration
Alerts on schtasks.exe /create executions indicating scheduled task creation, with exclusions for Office integrator-related cases.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-01-16
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where schtasks.exe is invoked with the /create argument, indicating scheduled task creation. Attackers commonly use scheduled tasks for persistence and can leverage them for privilege escalation by executing commands at specific times. It relies on Windows process creation telemetry, matching the executable path/name and required command-line fragments, while excluding events tied to the Office integration tasks to reduce noise.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows schtasks.exe Scheduled Task Creation by Non-Microsoft Office Integration
id: a78181ca-0456-4db5-8df1-8e6dbe8df7c9
status: test
description: This rule flags process creation where schtasks.exe is invoked with the /create argument, indicating scheduled task creation. Attackers commonly use scheduled tasks for persistence and can leverage them for privilege escalation by executing commands at specific times. It relies on Windows process creation telemetry, matching the executable path/name and required command-line fragments, while excluding events tied to the Office integration tasks to reduce noise.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_creation.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-01-16
modified: 2025-10-22
tags:
- attack.execution
- attack.persistence
- attack.privilege-escalation
- attack.t1053.005
- attack.s0111
- car.2013-08-001
- stp.1u
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \schtasks.exe
CommandLine|contains: " /create "
filter_main_system_user:
User|contains:
- AUTHORI
- AUTORI
filter_optional_msoffice:
ParentImage:
- C:\Program Files\Microsoft Office\root\integration\integrator.exe
- C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe
Image:
- C:\Windows\System32\schtasks.exe
- C:\Windows\SysWOW64\schtasks.exe
CommandLine|contains: Microsoft\Office\Office Performance Monitor
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Administrative activity
- Software installation
level: low
license: DRL-1.1
related:
- id: 92626ddd-662c-49e3-ac59-f6535f12d189
type: derived