Windows GPO Scheduled Task Persistence via SYSVOL ScheduledTasks.xml Writes (Security 5136/5145)
Alerts on GPO changes writing ScheduledTasks.xml to SYSVOL, indicating scheduled-task persistence at scale.
- Product
- windows
- Service
- security
- Author
- Samir Bousseaden (SigmaHQ), DRL 1.1
- Published
- 2019-04-03
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows Group Policy changes that add or modify scheduled task files in SYSVOL by matching specific GPO extension identifiers and write access events. Attackers abuse GPO scheduled tasks to execute payloads across many systems without installing software locally, making abuse a high-impact persistence and execution technique. It relies on Windows Security event 5136 (directory object changes for GPO extension attributes) and Security event 5145 (file share access targeting ScheduledTasks.xml under SYSVOL with write permissions).
Reporting behind it
- twitter.comhttps://twitter.com/menasec1/status/1106899890377052160
- secureworks.comhttps://www.secureworks.com/blog/ransomware-as-a-distraction
- elastic.cohttps://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_gpo_scheduledtasks.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows GPO Scheduled Task Persistence via SYSVOL ScheduledTasks.xml Writes (Security 5136/5145)
id: 6862793a-49f7-4887-afb1-2466082c39ee
status: test
description: This rule identifies Windows Group Policy changes that add or modify scheduled task files in SYSVOL by matching specific GPO extension identifiers and write access events. Attackers abuse GPO scheduled tasks to execute payloads across many systems without installing software locally, making abuse a high-impact persistence and execution technique. It relies on Windows Security event 5136 (directory object changes for GPO extension attributes) and Security event 5145 (file share access targeting ScheduledTasks.xml under SYSVOL with write permissions).
references:
- https://twitter.com/menasec1/status/1106899890377052160
- https://www.secureworks.com/blog/ransomware-as-a-distraction
- https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_gpo_scheduledtasks.yml
author: Samir Bousseaden, Huntrule Team
date: 2019-04-03
modified: 2024-09-04
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.lateral-movement
- attack.t1053.005
logsource:
product: windows
service: security
definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure
detection:
selection_5136:
EventID: 5136
AttributeLDAPDisplayName:
- gPCMachineExtensionNames
- gPCUserExtensionNames
AttributeValue|contains:
- CAB54552-DEEA-4691-817E-ED4A4D1AFC72
- AADCED64-746C-4633-A97C-D61349046527
selection_5145:
EventID: 5145
ShareName|endswith: \SYSVOL
RelativeTargetName|endswith: ScheduledTasks.xml
AccessList|contains:
- WriteData
- "%%4417"
condition: 1 of selection_*
falsepositives:
- If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduled tasks.
level: high
license: DRL-1.1
related:
- id: a8f29a7b-b137-4446-80a0-b804272f3da2
type: derived