Windows schtasks.exe scheduled task creation or modification with high privileges on suspicious schedule types
Flags schtasks.exe commands that create/modify tasks to run on ONLOGON/ONSTART/ONCE/ONIDLE with SYSTEM or HIGHEST privileges.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-31
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of schtasks.exe where the command line indicates the task is scheduled using ONLOGON, ONSTART, ONCE, or ONIDLE. It also requires the task run level to include high-privilege indicators such as NT AUTHORITY\SYSTEM (NT AUT), SYSTEM, or HIGHEST. Such scheduling and privilege elevation can help an attacker establish persistence or run code with elevated rights. The detection relies on Windows process creation telemetry and examines the command line for these schedule and privilege markers.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type_system.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows schtasks.exe scheduled task creation or modification with high privileges on suspicious schedule types
id: 72dedafe-2328-4c77-8d3c-64812ed68b93
related:
- id: 24c8392b-aa3c-46b7-a545-43f71657fe98
type: similar
- id: 7a02e22e-b885-4404-b38b-1ddc7e65258a
type: derived
status: test
description: This rule flags process executions of schtasks.exe where the command line indicates the task is scheduled using ONLOGON, ONSTART, ONCE, or ONIDLE. It also requires the task run level to include high-privilege indicators such as NT AUTHORITY\SYSTEM (NT AUT), SYSTEM, or HIGHEST. Such scheduling and privilege elevation can help an attacker establish persistence or run code with elevated rights. The detection relies on Windows process creation telemetry and examines the command line for these schedule and privilege markers.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type_system.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-31
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.t1053.005
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \schtasks.exe
- OriginalFileName: schtasks.exe
selection_time:
CommandLine|contains:
- " ONLOGON "
- " ONSTART "
- " ONCE "
- " ONIDLE "
selection_privs:
CommandLine|contains:
- NT AUT
- " SYSTEM"
- HIGHEST
condition: all of selection_*
falsepositives:
- Some installers were seen using this method of creation unfortunately. Filter them in your environment
level: medium
license: DRL-1.1