Windows schtasks.exe scheduled task creation from suspicious folders

Alerts on schtasks.exe /create using PowerShell/cmd and suspicious folder paths like ProgramData.

FreeUnreviewedSigmahighv1

windows-schtasks-exe-scheduled-task-creation-from-suspicious-folders-8a8379b8

title: Windows schtasks.exe scheduled task creation from suspicious folders
id: 28a1ba70-ff2f-44cd-b2b7-ff5e9da86be5
status: test
description: This rule flags process creation where schtasks.exe is used with a /create command and the action references suspicious folder paths such as C:\ProgramData\ or %ProgramData%. Attackers often use scheduled tasks for persistence by placing commands in commonly abused locations and invoking them via command-line tooling. It relies on Windows process creation telemetry, matching schtasks.exe invocations and the presence of /create along with PowerShell/cmd command patterns and suspicious folder strings within the CommandLine.
references:
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_folder_combos.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-15
modified: 2022-11-18
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1053.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_create:
    CommandLine|contains: " /create "
  selection_command:
    CommandLine|contains:
      - powershell
      - pwsh
      - "cmd /c "
      - "cmd /k "
      - "cmd /r "
      - "cmd.exe /c "
      - "cmd.exe /k "
      - "cmd.exe /r "
  selection_all_folders:
    CommandLine|contains:
      - C:\ProgramData\
      - "%ProgramData%"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8a8379b8-780b-4dbf-b1e9-31c8d112fefb
    type: derived

What it detects

This rule flags process creation where schtasks.exe is used with a /create command and the action references suspicious folder paths such as C:\ProgramData\ or %ProgramData%. Attackers often use scheduled tasks for persistence by placing commands in commonly abused locations and invoking them via command-line tooling. It relies on Windows process creation telemetry, matching schtasks.exe invocations and the presence of /create along with PowerShell/cmd command patterns and suspicious folder strings within the CommandLine.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.