Windows schtasks.exe scheduled task creation or modification with high privileges on suspicious schedule types

Flags schtasks.exe commands that create/modify tasks to run on ONLOGON/ONSTART/ONCE/ONIDLE with SYSTEM or HIGHEST privileges.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-08-31
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1053.005Scheduled Task
Persistence
- T1053.005Scheduled Task
Priv Esc
- T1053.005Scheduled Task
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions of schtasks.exe where the command line indicates the task is scheduled using ONLOGON, ONSTART, ONCE, or ONIDLE. It also requires the task run level to include high-privilege indicators such as NT AUTHORITY\SYSTEM (NT AUT), SYSTEM, or HIGHEST. Such scheduling and privilege elevation can help an attacker establish persistence or run code with elevated rights. The detection relies on Windows process creation telemetry and examines the command line for these schedule and privilege markers.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange

Scheduled Task Masquerading as Microsoft Wininet Config

Suspicious SYSTEM Scheduled Task Named test Created via schtasks

Suspicious Scheduled Task Created by Windows Script Host

Malicious CloudZ RAT Persistence via schtasks Running regasm.exe

Suspicious Scheduled Task Creation for WSPrint Persistence by UAT-9244

Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell

Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware

Malicious Scheduled Task Masquerading as Edge Update Running From Temp (via process_creation)

Suspicious Scheduled Task Created From XML Definition (via process_creation)

Windows schtasks.exe scheduled task creation or modification with high privileges on suspicious schedule types

Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-schtasks-exe-scheduled-task-creation-or-modification-with-high-privilege-7a02e22e

title: Windows schtasks.exe scheduled task creation or modification with high privileges on suspicious schedule types
id: 72dedafe-2328-4c77-8d3c-64812ed68b93
related:
  - id: 24c8392b-aa3c-46b7-a545-43f71657fe98
    type: similar
  - id: 7a02e22e-b885-4404-b38b-1ddc7e65258a
    type: derived
status: test
description: This rule flags process executions of schtasks.exe where the command line indicates the task is scheduled using ONLOGON, ONSTART, ONCE, or ONIDLE. It also requires the task run level to include high-privilege indicators such as NT AUTHORITY\SYSTEM (NT AUT), SYSTEM, or HIGHEST. Such scheduling and privilege elevation can help an attacker establish persistence or run code with elevated rights. The detection relies on Windows process creation telemetry and examines the command line for these schedule and privilege markers.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type_system.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-31
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1053.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_time:
    CommandLine|contains:
      - " ONLOGON "
      - " ONSTART "
      - " ONCE "
      - " ONIDLE "
  selection_privs:
    CommandLine|contains:
      - NT AUT
      - " SYSTEM"
      - HIGHEST
  condition: all of selection_*
falsepositives:
  - Some installers were seen using this method of creation unfortunately. Filter them in your environment
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL