Windows: Weekly Scheduled Task Creation for "shutdown /l /f" via schtasks.exe
Flags schtasks.exe creating a weekly scheduled task that runs "shutdown /l /f" on Windows.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-03-22
- Updated
- 2026-07-31
What it detects
This rule identifies process executions of schtasks.exe where the command line creates a scheduled task configured to run weekly and includes the shutdown /l /f command. Such task creation can enable persistence or repeated execution of attacker-controlled behavior. The detection relies on Windows process creation telemetry, matching schtasks.exe in the image path and required command-line substrings, while excluding events for specific system user patterns.
Reporting behind it
- nextron-systems.comhttps://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
- tria.gehttps://tria.ge/240123-rapteaahhr/behavioral1
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/KamiKakaBot/proc_creation_win_malware_kamikakabot_schtasks_persistence.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-schtasks-exe-weekly-task-creation-with-forced-user-shutdown-command-fe9e8ba9
title: 'Windows: Weekly Scheduled Task Creation for "shutdown /l /f" via schtasks.exe'
id: 4b7cfc25-c376-4c8e-ade1-d3a6de531dbb
status: test
description: This rule identifies process executions of schtasks.exe where the command line creates a scheduled task configured to run weekly and includes the shutdown /l /f command. Such task creation can enable persistence or repeated execution of attacker-controlled behavior. The detection relies on Windows process creation telemetry, matching schtasks.exe in the image path and required command-line substrings, while excluding events for specific system user patterns.
references:
- https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
- https://tria.ge/240123-rapteaahhr/behavioral1
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/KamiKakaBot/proc_creation_win_malware_kamikakabot_schtasks_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2024-03-22
tags:
- attack.persistence
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \schtasks.exe
CommandLine|contains|all:
- " /create "
- shutdown /l /f
- WEEKLY
filter_main_system_user:
User|contains:
- AUTHORI
- AUTORI
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: fe9e8ba9-4419-41e6-a574-bd9f7b3af961
type: derived