Scheduled Task Creation

Use case development / Detect Malware Infections / Detect Persistence Mechanisms

sigma

Detection rule

title: Scheduled Task Created via Command Line
status: experimental
description: Detects scheduled task creation via schtasks
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains: '/create'
  condition: selection
falsepositives:
  - Legitimate administration
level: medium
tags:
  - attack.persistence
  - attack.t1053.005

Test cases

• Create scheduled task via schtasks

False positive guidance

Monitor for tasks created outside IT ticketing systems.

Detection course