Windows Schtasks.exe Scheduled Task Creation or Modification with Suspicious Schedule Types
Alerts on schtasks.exe commands that schedule tasks using ONLOGON/ONSTART/ONCE/ONIDLE with potentially malicious privilege context.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-09
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of schtasks.exe where the command line includes specific schedule trigger types such as ONLOGON, ONSTART, ONCE, or ONIDLE. Attackers use scheduled tasks to persist and execute code at chosen events, making trigger selection an important signal. The detection relies on Windows process creation telemetry and matches on schtasks.exe plus trigger strings in the command line, while excluding cases that contain certain privilege indicators.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
- blog.talosintelligence.comhttp://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Schtasks.exe Scheduled Task Creation or Modification with Suspicious Schedule Types
id: a9f80551-9161-4f0c-90ee-416b5a7acdd9
related:
- id: 7a02e22e-b885-4404-b38b-1ddc7e65258a
type: similar
- id: 24c8392b-aa3c-46b7-a545-43f71657fe98
type: derived
status: test
description: This rule flags process executions of schtasks.exe where the command line includes specific schedule trigger types such as ONLOGON, ONSTART, ONCE, or ONIDLE. Attackers use scheduled tasks to persist and execute code at chosen events, making trigger selection an important signal. The detection relies on Windows process creation telemetry and matches on schtasks.exe plus trigger strings in the command line, while excluding cases that contain certain privilege indicators.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
- http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-09
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.t1053.005
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \schtasks.exe
- OriginalFileName: schtasks.exe
selection_time:
CommandLine|contains:
- " ONLOGON "
- " ONSTART "
- " ONCE "
- " ONIDLE "
filter_privs:
CommandLine|contains:
- NT AUT
- " SYSTEM"
- HIGHEST
condition: all of selection_* and not 1 of filter_*
falsepositives:
- Legitimate processes that run at logon. Filter according to your environment
level: high
license: DRL-1.1