Windows schtasks Scheduled Task Create/Modify Running as SYSTEM

title: Windows schtasks Scheduled Task Create/Modify Running as SYSTEM
id: f97e4491-ab57-4aad-ba90-5a6cec736ec0
status: test
description: This rule flags process executions of schtasks.exe that create or modify scheduled tasks configured to run under NT AUTHORITY\SYSTEM. Attackers commonly use scheduled tasks for privilege escalation, persistence, and execution as highly privileged accounts. Detection relies on Windows process creation telemetry, specifically the schtasks.exe command line parameters indicating /create or /change and the /ru value set to SYSTEM.
references:
  - https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_system.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-28
modified: 2025-02-15
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_root:
    Image|endswith: \schtasks.exe
    CommandLine|contains:
      - " /change "
      - " /create "
  selection_run:
    CommandLine|contains: "/ru "
  selection_user:
    CommandLine|contains:
      - NT AUT
      - " SYSTEM "
  filter_optional_teamviewer:
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
      - /TN TVInstallRestore
      - \TeamViewer_.exe
  filter_optional_office:
    CommandLine|contains|all:
      - Subscription Heartbeat
      - \HeartbeatConfig.xml
      - \Microsoft Shared\OFFICE
  filter_optional_avira:
    CommandLine|contains:
      - "/Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR "
      - :\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe
      - /VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART" /RL HIGHEST
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 89ca78fd-b37c-4310-b3d3-81a023f83936
    type: derived