Windows: Suspicious Scheduled Task Modification via schtasks /Change /TN

title: "Windows: Suspicious Scheduled Task Modification via schtasks /Change /TN"
id: 295efdbd-e2da-46e9-ac09-34d4aee2007a
related:
  - id: 614cf376-6651-47c4-9dcc-6b9527f749f4
    type: similar
  - id: 1c0e41cd-21bb-4433-9acc-4a2cd6367b9b
    type: derived
status: test
description: This rule identifies process executions of schtasks.exe where the command line includes both the scheduled task modification switch (/Change) and a task name (/TN). It further requires that the command line references common attacker-preferred or nonstandard locations and/or that it contains scripting or living-off-the-land binaries (for example cmd, powershell, mshta, wscript, certutil, wmic) commonly used to embed payloads into the task. The detection relies on Windows process creation telemetry, using command-line contents to flag attempts to alter existing persistence mechanisms after task creation.
references:
  - Internal Research
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_change.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-28
modified: 2022-11-18
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1053.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_schtasks:
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
      - " /Change "
      - " /TN "
  selection_susp_locations:
    CommandLine|contains:
      - \AppData\Local\Temp
      - \AppData\Roaming\
      - \Users\Public\
      - \WINDOWS\Temp\
      - \Desktop\
      - \Downloads\
      - \Temporary Internet
      - C:\ProgramData\
      - C:\Perflogs\
      - "%ProgramData%"
      - "%appdata%"
      - "%comspec%"
      - "%localappdata%"
  selection_susp_images:
    CommandLine|contains:
      - regsvr32
      - rundll32
      - "cmd /c "
      - "cmd /k "
      - "cmd /r "
      - "cmd.exe /c "
      - "cmd.exe /k "
      - "cmd.exe /r "
      - powershell
      - mshta
      - wscript
      - cscript
      - certutil
      - bitsadmin
      - bash.exe
      - "bash "
      - scrcons
      - "wmic "
      - wmic.exe
      - forfiles
      - scriptrunner
      - hh.exe
      - "hh "
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1