{"id":"92626ddd-662c-49e3-ac59-f6535f12d189","title":"Scheduled Task Creation Via Schtasks.EXE","description":"Detects the creation of scheduled tasks by user accounts via the \"schtasks\" utility.","author":"Florian Roth (Nextron Systems)","status":"test","level":"low","date":"2019-01-16","modified":"2025-10-22","tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.t1053.005","attack.s0111","car.2013-08-001","stp.1u"],"technique_ids":["T1053.005"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Administrative activity","Software installation"],"references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create"],"source_path":"rules/windows/process_creation/proc_creation_win_schtasks_creation.yml","source_sha256":"2f8ca8539179e6851171dd23f0d2e5a690e59b30d949aa6e29d04e7b33f82227","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_schtasks_creation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Scheduled Task Creation Via Schtasks.EXE\nid: 92626ddd-662c-49e3-ac59-f6535f12d189\nstatus: test\ndescription: Detects the creation of scheduled tasks by user accounts via the \"schtasks\" utility.\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-01-16\nmodified: 2025-10-22\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1053.005\n    - attack.s0111\n    - car.2013-08-001\n    - stp.1u\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\schtasks.exe'\n        CommandLine|contains: ' /create '\n    filter_main_system_user:\n        User|contains: # covers many language settings\n            - 'AUTHORI'\n            - 'AUTORI'\n    filter_optional_msoffice:\n        #  schtasks.exe /Create /tn \"Microsoft\\Office\\Office Performance Monitor\" /XML \"C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_Office Performance Monitor.xml\"\n        ParentImage:\n            - 'C:\\Program Files\\Microsoft Office\\root\\integration\\integrator.exe'\n            - 'C:\\Program Files (x86)\\Microsoft Office\\root\\integration\\integrator.exe'\n        Image:\n            - 'C:\\Windows\\System32\\schtasks.exe'\n            - 'C:\\Windows\\SysWOW64\\schtasks.exe'\n        CommandLine|contains: 'Microsoft\\Office\\Office Performance Monitor'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Administrative activity\n    - Software installation\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","page":"techniques/enterprise/T1053.005/"}],"data_path":"data/detection-rules/92626ddd-662c-49e3-ac59-f6535f12d189.json","kind":"sigma"}