T1053.005 Scheduled Task — Detection Rules

Source-backed rule directory

• Persistence and Execution at Scale via GPO Scheduled Task · test · high · {"product":"windows","service":"security","definition":"The advanced audit policy setting \"Object Access > Audit Detailed File Share\" must be configured for Success/Failure"}
• Suspicious Scheduled Task Creation · test · high · {"product":"windows","service":"security","definition":"The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data."}
• Important Scheduled Task Deleted/Disabled · test · high · {"product":"windows","service":"security","definition":"The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data."}
• Suspicious Scheduled Task Update · test · high · {"product":"windows","service":"security","definition":"The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data."}
• Scheduled Task Executed From A Suspicious Location · test · medium · {"product":"windows","service":"taskscheduler","definition":"Requirements: The \"Microsoft-Windows-TaskScheduler/Operational\" is disabled by default and needs to be enabled in order for this detection to trigger"}
• Scheduled Task Executed Uncommon LOLBIN · test · medium · {"product":"windows","service":"taskscheduler","definition":"Requirements: The \"Microsoft-Windows-TaskScheduler/Operational\" is disabled by default and needs to be enabled in order for this detection to trigger"}
• Powershell Create Scheduled Task · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• HackTool - Default PowerSploit/Empire Scheduled Task Creation · test · high · {"product":"windows","category":"process_creation"}
• Renamed Schtasks Execution · experimental · high · {"category":"process_creation","product":"windows"}
• Suspicious Schtasks Execution AppData Folder · test · high · {"product":"windows","category":"process_creation"}
• Suspicious Modification Of Scheduled Tasks · test · high · {"product":"windows","category":"process_creation"}
• Scheduled Task Creation Via Schtasks.EXE · test · low · {"category":"process_creation","product":"windows"}
• Suspicious Scheduled Task Creation Involving Temp Folder · test · high · {"category":"process_creation","product":"windows"}
• Scheduled Task Creation with Curl and PowerShell Execution Combo · experimental · medium · {"category":"process_creation","product":"windows"}
• Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE · test · medium · {"product":"windows","category":"process_creation"}
• Schtasks From Suspicious Folders · test · high · {"product":"windows","category":"process_creation"}
• Suspicious Scheduled Task Name As GUID · test · medium · {"product":"windows","category":"process_creation"}
• Uncommon One Time Only Scheduled Task At 00:00 · test · high · {"category":"process_creation","product":"windows"}
• Potential SSH Tunnel Persistence Install Using A Scheduled Task · experimental · high · {"product":"windows","category":"process_creation"}
• Potential Persistence Via Microsoft Compatibility Appraiser · test · medium · {"product":"windows","category":"process_creation"}
• Potential Persistence Via Powershell Search Order Hijacking - Task · test · high · {"product":"windows","category":"process_creation"}
• Scheduled Task Executing Payload from Registry · test · medium · {"product":"windows","category":"process_creation"}
• Scheduled Task Executing Encoded Payload from Registry · test · high · {"product":"windows","category":"process_creation"}
• Suspicious Schtasks Schedule Types · test · high · {"product":"windows","category":"process_creation"}
• Suspicious Schtasks Schedule Type With High Privileges · test · medium · {"product":"windows","category":"process_creation"}
• Suspicious Scheduled Task Creation via Masqueraded XML File · test · medium · {"product":"windows","category":"process_creation"}
• Suspicious Command Patterns In Scheduled Task Creation · test · high · {"product":"windows","category":"process_creation"}
• Schtasks Creation Or Modification With SYSTEM Privileges · test · high · {"product":"windows","category":"process_creation"}
• Scheduled Task Creation Masquerading as System Processes · experimental · high · {"category":"process_creation","product":"windows"}
• Scheduled TaskCache Change by Uncommon Program · test · high · {"category":"registry_set","product":"windows"}
• Potential Registry Persistence Attempt Via Windows Telemetry · test · high · {"category":"registry_set","product":"windows","definition":"Requirements: Sysmon config that monitors \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController subkey of the HKLM hives"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0441 Detection of Suspicious Scheduled Task Creation and Execution on Windows

AN1221 Analytic 1221

Detects the creation, modification, or deletion of scheduled tasks through Task Scheduler, WMI, PowerShell, or API-based methods followed by execution from svchost.exe or taskeng.exe. Includes detection of hidden or anomalous scheduled tasks, especially those created under SYSTEM or suspicious user contexts.