Windows schtasks.exe scheduled task creation or modification with high privileges on suspicious schedule types

Flags schtasks.exe commands that create/modify tasks to run on ONLOGON/ONSTART/ONCE/ONIDLE with SYSTEM or HIGHEST privileges.

FreeUnreviewedSigmamediumv1

windows-schtasks-exe-scheduled-task-creation-or-modification-with-high-privilege-7a02e22e

title: Windows schtasks.exe scheduled task creation or modification with high privileges on suspicious schedule types
id: 72dedafe-2328-4c77-8d3c-64812ed68b93
related:
  - id: 24c8392b-aa3c-46b7-a545-43f71657fe98
    type: similar
  - id: 7a02e22e-b885-4404-b38b-1ddc7e65258a
    type: derived
status: test
description: This rule flags process executions of schtasks.exe where the command line indicates the task is scheduled using ONLOGON, ONSTART, ONCE, or ONIDLE. It also requires the task run level to include high-privilege indicators such as NT AUTHORITY\SYSTEM (NT AUT), SYSTEM, or HIGHEST. Such scheduling and privilege elevation can help an attacker establish persistence or run code with elevated rights. The detection relies on Windows process creation telemetry and examines the command line for these schedule and privilege markers.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type_system.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-31
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1053.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_time:
    CommandLine|contains:
      - " ONLOGON "
      - " ONSTART "
      - " ONCE "
      - " ONIDLE "
  selection_privs:
    CommandLine|contains:
      - NT AUT
      - " SYSTEM"
      - HIGHEST
  condition: all of selection_*
falsepositives:
  - Some installers were seen using this method of creation unfortunately. Filter them in your environment
level: medium
license: DRL-1.1

What it detects

This rule flags process executions of schtasks.exe where the command line indicates the task is scheduled using ONLOGON, ONSTART, ONCE, or ONIDLE. It also requires the task run level to include high-privilege indicators such as NT AUTHORITY\SYSTEM (NT AUT), SYSTEM, or HIGHEST. Such scheduling and privilege elevation can help an attacker establish persistence or run code with elevated rights. The detection relies on Windows process creation telemetry and examines the command line for these schedule and privilege markers.

Known false positives

Some installers were seen using this method of creation unfortunately. Filter them in your environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.