Windows schtasks.exe Weekly Task Creation with Forced User Shutdown Command

title: Windows schtasks.exe Weekly Task Creation with Forced User Shutdown Command
id: 4b7cfc25-c376-4c8e-ade1-d3a6de531dbb
status: test
description: This rule identifies execution of schtasks.exe that creates a scheduled task set to run weekly and includes the command "shutdown /l /f". Attackers may use this to control system state and maintain execution or disruption as part of persistence or operational activity. The detection relies on Windows process creation telemetry, matching schtasks.exe and inspecting the full command line for the scheduled task creation parameters and shutdown command.
references:
  - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
  - https://tria.ge/240123-rapteaahhr/behavioral1
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/KamiKakaBot/proc_creation_win_malware_kamikakabot_schtasks_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2024-03-22
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
      - " /create "
      - shutdown /l /f
      - WEEKLY
  filter_main_system_user:
    User|contains:
      - AUTHORI
      - AUTORI
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: fe9e8ba9-4419-41e6-a574-bd9f7b3af961
    type: derived