Potential BearLPE Exploitation via Windows Task Scheduler schtasks.exe DACL Change
Flags schtasks.exe executions with /change, /TN, /RU, and /RP, consistent with task modification tied to BearLPE attempts.
- Product
- windows
- Category
- process_creation
- Author
- Olaf Hartong (SigmaHQ), DRL 1.1
- Published
- 2019-05-22
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where schtasks.exe is invoked with command-line arguments that indicate changing a scheduled task and configuring it to run as a specified user with a specified password. The combination of /change, /TN, /RU, and /RP is used to modify task settings in a way that can be leveraged for privilege escalation attempts consistent with BearLPE exploitation activity. Telemetry required is Windows process creation events including the process image name and full command line.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Potential BearLPE Exploitation via Windows Task Scheduler schtasks.exe DACL Change
id: 27b34f72-66d6-434d-a91e-cf9ada4e211a
status: test
description: This rule flags Windows process creation where schtasks.exe is invoked with command-line arguments that indicate changing a scheduled task and configuring it to run as a specified user with a specified password. The combination of /change, /TN, /RU, and /RP is used to modify task settings in a way that can be leveraged for privilege escalation attempts consistent with BearLPE exploitation activity. Telemetry required is Windows process creation events including the process image name and full command line.
references:
- https://github.com/djhohnstein/polarbearrepo/blob/f26d3e008093cc5c835e92a7165170baf6713d43/bearlpe/polarbear/polarbear/exploit.cpp
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/BearLPE-Exploit/proc_creation_win_exploit_other_bearlpe.yml
author: Olaf Hartong, Huntrule Team
date: 2019-05-22
modified: 2023-01-26
tags:
- attack.persistence
- attack.execution
- attack.privilege-escalation
- attack.t1053.005
- car.2013-08-001
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \schtasks.exe
- OriginalFileName: schtasks.exe
selection_cli:
CommandLine|contains|all:
- /change
- /TN
- /RU
- /RP
condition: all of selection*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 931b6802-d6a6-4267-9ffa-526f57f22aaf
type: derived