{"id":"81325ce1-be01-4250-944f-b4789644556f","title":"Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE","description":"Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-02-21","modified":"2025-10-07","tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1053.005"],"technique_ids":["T1053.005"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Benign scheduled tasks creations or executions that happen often during software installations","Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders"],"references":["https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/","https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04","https://blog.talosintelligence.com/gophish-powerrat-dcrat/"],"source_path":"rules/windows/process_creation/proc_creation_win_schtasks_env_folder.yml","source_sha256":"35f2540341966e0cfe29bdacd0d18b2e1a8acf7b9c32fbf5ee00628f397eeecf","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_schtasks_env_folder.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE\nid: 81325ce1-be01-4250-944f-b4789644556f\nrelated:\n    - id: 43f487f0-755f-4c2a-bce7-d6d2eec2fcf8 # TODO: Recreate after baseline\n      type: derived\nstatus: test\ndescription: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware\nreferences:\n    - https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/\n    - https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04\n    - https://blog.talosintelligence.com/gophish-powerrat-dcrat/\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-02-21\nmodified: 2025-10-07\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.execution\n    - attack.t1053.005\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_1_create:\n        Image|endswith: '\\schtasks.exe'\n        CommandLine|contains|windash: ' /create '\n    selection_1_all_folders:\n        CommandLine|contains:\n            - ':\\Perflogs'\n            - ':\\Users\\All Users\\'\n            - ':\\Users\\Default\\'\n            - ':\\Users\\Public'\n            - ':\\Windows\\Temp'\n            - '\\AppData\\Local\\'\n            - '\\AppData\\Roaming\\'\n            - '%AppData%'\n            - '%Public%'\n    selection_2_parent:\n        ParentCommandLine|endswith: '\\svchost.exe -k netsvcs -p -s Schedule'\n    selection_2_some_folders:\n        CommandLine|contains:\n            - ':\\Perflogs'\n            - ':\\Windows\\Temp'\n            - '\\Users\\Public'\n            - '%Public%'\n    filter_optional_other:\n        - ParentCommandLine|contains: 'unattended.ini'\n        - CommandLine|contains: 'update_task.xml'\n    filter_optional_team_viewer:\n        CommandLine|contains: '/Create /TN TVInstallRestore /TR'\n    filter_optional_avira_install:\n        # Comment out this filter if you dont use AVIRA\n        CommandLine|contains|all:\n            - '/Create /Xml '\n            - '\\Temp\\.CR.'\n            - '\\Avira_Security_Installation.xml'\n    filter_optional_avira_other:\n        # Comment out this filter if you dont use AVIRA\n        CommandLine|contains|all:\n            - '/Create /F /TN'\n            - '/Xml '\n            - '\\Temp\\'\n            - 'Avira_'\n        CommandLine|contains:\n            - '.tmp\\UpdateFallbackTask.xml'\n            - '.tmp\\WatchdogServiceControlManagerTimeout.xml'\n            - '.tmp\\SystrayAutostart.xml'\n            - '.tmp\\MaintenanceTask.xml'\n    filter_optional_klite_codec:\n        CommandLine|contains|all:\n            - '\\Temp\\'\n            - '/Create /TN \"klcp_update\" /XML '\n            - '\\klcp_update_task.xml'\n    condition: ( all of selection_1_* or all of selection_2_* ) and not 1 of filter_optional_*\nfalsepositives:\n    - Benign scheduled tasks creations or executions that happen often during software installations\n    - Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","page":"techniques/enterprise/T1053.005/"}],"data_path":"data/detection-rules/81325ce1-be01-4250-944f-b4789644556f.json","kind":"sigma"}