Windows Schtasks.exe renamed execution used to create, modify, run, or delete scheduled tasks

Alerts on scheduled task management commands that use a renamed schtasks.exe binary on Windows.

FreeReviewedSigma · High · v3

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-11-27
Updated: 2026-10-03

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1053.005Scheduled Task
Persistence
- T1053.005Scheduled Task
Priv Esc
- T1053.005Scheduled Task
Defense Evasion
- T1036.003Rename Legitimate Utilities
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the executed image ends with \schtasks.exe or the process original file name is schtasks.exe, while the command line includes schtasks-related operations such as /create, /delete, /query, /change, /run, or /end. Renaming schtasks.exe can help attackers blend into expected tooling while using it for persistence via scheduled tasks. The detection relies on Windows process creation telemetry, including Image, OriginalFileName, and CommandLine, and excludes cases involving openfiles queries.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange

Suspicious Scheduled Task CacheTask Reconfigured to Run as SYSTEM

Malicious NodeSnake RAT Persistence via Scheduled Task and Node.js (via process_creation)

Malicious Scheduled Task Masquerading as Windows Defender Sync via schtasks (via process_creation)

Suspicious Scheduled Task Creation Launching mshta via schtasks (via process_creation)

Suspicious Renamed PowerShell Binary Execution (via process_creation)

Suspicious Service or Task Named windowsinspectionupdate (via process_creation)

Possible DarkGate Process Injection via iTunesHelper Spawning vbc.exe

Suspicious Renamed PowerShell Copied from System32 via Batch Loader

Suspicious Scheduled Task Creation Referencing dllFake Batch Scripts (via process_creation)

Windows Schtasks.exe renamed execution used to create, modify, run, or delete scheduled tasks

Pivot detection · T1053.005 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-10-03
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-schtasks-execution-with-renamed-schtasks-exe-binary-f91e51c9

title: Windows Schtasks.exe renamed execution used to create, modify, run, or delete scheduled tasks
id: 2179894d-58fa-461e-913d-9a61201f3014
status: experimental
description: This rule flags process creation events where the executed image ends with \schtasks.exe or the process original file name is schtasks.exe, while the command line includes schtasks-related operations such as /create, /delete, /query, /change, /run, or /end. Renaming schtasks.exe can help attackers blend into expected tooling while using it for persistence via scheduled tasks. The detection relies on Windows process creation telemetry, including Image, OriginalFileName, and CommandLine, and excludes cases involving openfiles queries.
references:
  - https://x.com/JangPr0/status/1932034543026065833
  - https://ss64.com/nt/schtasks.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_schtasks_execution.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-27
modified: 2026-10-02
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1036.003
  - attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd_operation:
    CommandLine|contains|windash:
      - " /create "
      - " /delete "
      - " /query "
      - " /change "
      - " /run "
      - " /end "
  selection_cmd_flags:
    CommandLine|contains|windash:
      - " /tn "
      - " /tr "
      - " /sc "
      - " /st "
      - " /ru "
      - " /fo "
  selection_pe:
    OriginalFileName: schtasks.exe
  filter_main_cmd:
    CommandLine|contains: schtasks
  filter_main_img:
    Image|endswith: \schtasks.exe
  filter_optional_cmd_openfiles:
    CommandLine|contains|all:
      - openfiles
      - " /query "
      - " /fo"
  condition: (all of selection_cmd_* and not filter_main_cmd and not filter_optional_cmd_openfiles) or (selection_pe and not filter_main_img)
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_schtasks_execution/info.yml
license: DRL-1.1
related:
  - id: f91e51c9-f344-4b32-969b-0b6f6b8537d4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL