Windows: Weekly Scheduled Task Creation for "shutdown /l /f" via schtasks.exe

title: 'Windows: Weekly Scheduled Task Creation for "shutdown /l /f" via schtasks.exe'
id: 4b7cfc25-c376-4c8e-ade1-d3a6de531dbb
status: test
description: This rule identifies process executions of schtasks.exe where the command line creates a scheduled task configured to run weekly and includes the shutdown /l /f command. Such task creation can enable persistence or repeated execution of attacker-controlled behavior. The detection relies on Windows process creation telemetry, matching schtasks.exe in the image path and required command-line substrings, while excluding events for specific system user patterns.
references:
  - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
  - https://tria.ge/240123-rapteaahhr/behavioral1
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/KamiKakaBot/proc_creation_win_malware_kamikakabot_schtasks_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2024-03-22
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
      - " /create "
      - shutdown /l /f
      - WEEKLY
  filter_main_system_user:
    User|contains:
      - AUTHORI
      - AUTORI
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: fe9e8ba9-4419-41e6-a574-bd9f7b3af961
    type: derived