Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE — Sigma Rule

Rule metadata and linked tags

Author: Florian Roth (Nextron Systems). Source status: test; severity: medium. Source dates: 2022-02-21 / 2025-10-07.

{
  "product": "windows",
  "category": "process_creation"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 35f2540341966e0cfe29bdacd0d18b2e1a8acf7b9c32fbf5ee00628f397eeecf

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
id: 81325ce1-be01-4250-944f-b4789644556f
related:
    - id: 43f487f0-755f-4c2a-bce7-d6d2eec2fcf8 # TODO: Recreate after baseline
      type: derived
status: test
description: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware
references:
    - https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/
    - https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04
    - https://blog.talosintelligence.com/gophish-powerrat-dcrat/
author: Florian Roth (Nextron Systems)
date: 2022-02-21
modified: 2025-10-07
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.t1053.005
logsource:
    product: windows
    category: process_creation
detection:
    selection_1_create:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains|windash: ' /create '
    selection_1_all_folders:
        CommandLine|contains:
            - ':\Perflogs'
            - ':\Users\All Users\'
            - ':\Users\Default\'
            - ':\Users\Public'
            - ':\Windows\Temp'
            - '\AppData\Local\'
            - '\AppData\Roaming\'
            - '%AppData%'
            - '%Public%'
    selection_2_parent:
        ParentCommandLine|endswith: '\svchost.exe -k netsvcs -p -s Schedule'
    selection_2_some_folders:
        CommandLine|contains:
            - ':\Perflogs'
            - ':\Windows\Temp'
            - '\Users\Public'
            - '%Public%'
    filter_optional_other:
        - ParentCommandLine|contains: 'unattended.ini'
        - CommandLine|contains: 'update_task.xml'
    filter_optional_team_viewer:
        CommandLine|contains: '/Create /TN TVInstallRestore /TR'
    filter_optional_avira_install:
        # Comment out this filter if you dont use AVIRA
        CommandLine|contains|all:
            - '/Create /Xml '
            - '\Temp\.CR.'
            - '\Avira_Security_Installation.xml'
    filter_optional_avira_other:
        # Comment out this filter if you dont use AVIRA
        CommandLine|contains|all:
            - '/Create /F /TN'
            - '/Xml '
            - '\Temp\'
            - 'Avira_'
        CommandLine|contains:
            - '.tmp\UpdateFallbackTask.xml'
            - '.tmp\WatchdogServiceControlManagerTimeout.xml'
            - '.tmp\SystrayAutostart.xml'
            - '.tmp\MaintenanceTask.xml'
    filter_optional_klite_codec:
        CommandLine|contains|all:
            - '\Temp\'
            - '/Create /TN "klcp_update" /XML '
            - '\klcp_update_task.xml'
    condition: ( all of selection_1_* or all of selection_2_* ) and not 1 of filter_optional_*
falsepositives:
    - Benign scheduled tasks creations or executions that happen often during software installations
    - Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders
level: medium

Original YAML and metadata in JSON

False positives

• Benign scheduled tasks creations or executions that happen often during software installations
• Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders

Source references

• https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/
• https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04
• https://blog.talosintelligence.com/gophish-powerrat-dcrat/