{"id":"f91e51c9-f344-4b32-969b-0b6f6b8537d4","title":"Renamed Schtasks Execution","description":"Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks.\nOne of the very common persistence techniques is schedule malicious tasks using schtasks.exe.\nSince, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-27","modified":"","tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1036.003","attack.t1053.005"],"technique_ids":["T1036.003","T1053.005"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://x.com/JangPr0/status/1932034543026065833","https://ss64.com/nt/schtasks.html"],"source_path":"rules/windows/process_creation/proc_creation_win_renamed_schtasks_execution.yml","source_sha256":"3c9a309363d14552c5437f2ac422be588b02aed4cf27792f20c2504caff1c2d3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_schtasks_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Renamed Schtasks Execution\nid: f91e51c9-f344-4b32-969b-0b6f6b8537d4\nstatus: experimental\ndescription: |\n    Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks.\n    One of the very common persistence techniques is schedule malicious tasks using schtasks.exe.\n    Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.\nreferences:\n    - https://x.com/JangPr0/status/1932034543026065833\n    - https://ss64.com/nt/schtasks.html\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-11-27\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1036.003\n    - attack.t1053.005\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_cmd_operation:\n        CommandLine|contains|windash:\n            - ' /create '\n            - ' /delete '\n            - ' /query '\n            - ' /change '\n            - ' /run '\n            - ' /end '\n    selection_cmd_flags:\n        CommandLine|contains|windash:\n            - ' /tn '\n            - ' /tr '\n            - ' /sc '\n            - ' /st '\n            - ' /ru '\n            - ' /fo '\n    selection_pe:\n        OriginalFileName: 'schtasks.exe'\n    filter_main_cmd:\n        CommandLine|contains: 'schtasks'\n    filter_main_img:\n        Image|endswith: '\\schtasks.exe'\n    condition: (all of selection_cmd_* and not filter_main_cmd) or (selection_pe and not filter_main_img)\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.003","id":"T1036.003","name":"Rename Legitimate Utilities","page":"techniques/enterprise/T1036.003/"},{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","page":"techniques/enterprise/T1053.005/"}],"data_path":"data/detection-rules/f91e51c9-f344-4b32-969b-0b6f6b8537d4.json","kind":"sigma"}