Windows Schtasks.exe Scheduled Task Creation or Modification with Suspicious Schedule Types

Alerts on schtasks.exe commands that schedule tasks using ONLOGON/ONSTART/ONCE/ONIDLE with potentially malicious privilege context.

FreeUnreviewedSigmahighv1

windows-schtasks-exe-scheduled-task-creation-or-modification-with-suspicious-sch-24c8392b

title: Windows Schtasks.exe Scheduled Task Creation or Modification with Suspicious Schedule Types
id: a9f80551-9161-4f0c-90ee-416b5a7acdd9
related:
  - id: 7a02e22e-b885-4404-b38b-1ddc7e65258a
    type: similar
  - id: 24c8392b-aa3c-46b7-a545-43f71657fe98
    type: derived
status: test
description: This rule flags process executions of schtasks.exe where the command line includes specific schedule trigger types such as ONLOGON, ONSTART, ONCE, or ONIDLE. Attackers use scheduled tasks to persist and execute code at chosen events, making trigger selection an important signal. The detection relies on Windows process creation telemetry and matches on schtasks.exe plus trigger strings in the command line, while excluding cases that contain certain privilege indicators.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1053.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_time:
    CommandLine|contains:
      - " ONLOGON "
      - " ONSTART "
      - " ONCE "
      - " ONIDLE "
  filter_privs:
    CommandLine|contains:
      - NT AUT
      - " SYSTEM"
      - HIGHEST
  condition: all of selection_* and not 1 of filter_*
falsepositives:
  - Legitimate processes that run at logon. Filter according to your environment
level: high
license: DRL-1.1

What it detects

This rule flags process executions of schtasks.exe where the command line includes specific schedule trigger types such as ONLOGON, ONSTART, ONCE, or ONIDLE. Attackers use scheduled tasks to persist and execute code at chosen events, making trigger selection an important signal. The detection relies on Windows process creation telemetry and matches on schtasks.exe plus trigger strings in the command line, while excluding cases that contain certain privilege indicators.

Known false positives

Legitimate processes that run at logon. Filter according to your environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.