{"id":"T1053.005","name":"Scheduled Task","url":"https://attack.mitre.org/techniques/T1053/005","tactics":["execution","persistence","privilege-escalation"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0441","stix_id":"x-mitre-detection-strategy--c7bdd7d7-19dc-4042-8565-5e0cf4656102","name":"Detection of Suspicious Scheduled Task Creation and Execution on Windows","url":"https://attack.mitre.org/detectionstrategies/DET0441","analytics":[{"id":"AN1221","stix_id":"x-mitre-analytic--4959f750-78db-4b4c-8d91-23027b386c2b","name":"Analytic 1221","description":"Detects the creation, modification, or deletion of scheduled tasks through Task Scheduler, WMI, PowerShell, or API-based methods followed by execution from svchost.exe or taskeng.exe. Includes detection of hidden or anomalous scheduled tasks, especially those created under SYSTEM or suspicious user contexts.","url":"https://attack.mitre.org/detectionstrategies/DET0441#AN1221","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4698","data_component":"DC0001","data_component_name":"Scheduled Job Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4702","data_component":"DC0012","data_component_name":"Scheduled Job Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Defines threshold for grouping task creation and associated execution within suspicious time proximity."},{"field":"UserContext","description":"Filters based on non-standard user accounts or execution under SYSTEM when not typical for the environment."},{"field":"TaskNamePattern","description":"Allows defenders to flag obfuscated, randomized, or suspicious task names outside normal conventions."},{"field":"CommandLineEntropyThreshold","description":"Flags tasks executing heavily obfuscated PowerShell or binary blobs via base64 or encoding."}],"live":true,"detection_strategies":["DET0441"],"techniques":["T1053.005"]}],"live":true,"version":"1.0","techniques":["T1053.005"]}],"sigma_rules":[{"id":"0a74c5a9-1b71-4475-9af2-7829d320d5c2","title":"ChromeLoader Malware Execution","author":"@kostastsale","status":"test","level":"high","date":"2022-01-10","modified":null,"description":"Detects execution of ChromeLoader malware via a registered scheduled task","references":["https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER","https://twitter.com/th3_protoCOL/status/1480621526764322817","https://twitter.com/Kostastsale/status/1480716528421011458","https://www.virustotal.com/gui/file/ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.001","attack.t1176","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Malware/ChromeLoader/proc_creation_win_malware_chrome_loader_execution.yml","techniques":["T1053.005","T1059.001","T1176"],"cves":[]},{"id":"1c0e41cd-21bb-4433-9acc-4a2cd6367b9b","title":"Suspicious Modification Of Scheduled Tasks","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-28","modified":"2022-11-18","description":"Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location\nAttackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on\nInstead they modify the task after creation to include their malicious payload\n","references":["Internal Research","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_change.yml","techniques":["T1053.005"],"cves":[]},{"id":"1cfac73c-be78-4f9a-9b08-5bde0c3953ab","title":"Operation Wocao Activity","author":"Florian Roth (Nextron Systems), frack113","status":"test","level":"high","date":"2019-12-20","modified":"2022-10-09","description":"Detects activity mentioned in Operation Wocao report","references":["https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/","https://twitter.com/SBousseaden/status/1207671369963646976"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.discovery","attack.stealth","attack.t1012","attack.t1036.004","attack.t1027","attack.execution","attack.t1053.005","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/TA/Operation-Wocao/proc_creation_win_apt_wocao.yml","techniques":["T1012","T1036.004","T1027","T1053.005","T1059.001"],"cves":[]},{"id":"1d174d38-8fda-4081-a9b6-56d9763c0cd8","title":"Scheduled Task Creation with Curl and PowerShell Execution Combo","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-02-05","modified":null,"description":"Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them.\nThis facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.\n","references":["https://tria.ge/241015-l98snsyeje/behavioral2"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.stealth","attack.t1053.005","attack.t1218","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_curl_and_powershell_combo.yml","techniques":["T1053.005","T1218","T1105"],"cves":[]},{"id":"24c8392b-aa3c-46b7-a545-43f71657fe98","title":"Suspicious Schtasks Schedule Types","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-09","modified":null,"description":"Detects scheduled task creations or modification on a suspicious schedule type","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create","http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_schedule_type.yml","techniques":["T1053.005"],"cves":[]},{"id":"2daa93a0-a5fb-41c5-8cd8-3c11294bfd1f","title":"Potential SSH Tunnel Persistence Install Using A Scheduled Task","author":"Rory Duncan","status":"experimental","level":"high","date":"2025-07-14","modified":null,"description":"Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.","references":["https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/","https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1053.005","attack.command-and-control"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_openssh_tunnelling.yml","techniques":["T1053.005"],"cves":[]},{"id":"363eccc0-279a-4ccf-a3ab-24c2e63b11fb","title":"Powershell Create Scheduled Task","author":"frack113","status":"test","level":"medium","date":"2021-12-28","modified":"2025-10-07","description":"Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-4---powershell-cmdlet-scheduled-task","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-6---wmi-invoke-cimmethod-scheduled-task"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005"],"path":"rules/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml","techniques":["T1053.005"],"cves":[]},{"id":"39019a4e-317f-4ce3-ae63-309a8c6b53c5","title":"Suspicious Scheduled Task Creation Involving Temp Folder","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-03-11","modified":"2022-10-09","description":"Detects the creation of scheduled tasks that involves a temporary folder and runs only once","references":["https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_creation_temp_folder.yml","techniques":["T1053.005"],"cves":[]},{"id":"3a734d25-df5c-4b99-8034-af1ddb5883a4","title":"Suspicious Scheduled Task Creation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-05","modified":"2022-12-07","description":"Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"],"logsource":{"product":"windows","service":"security"},"tags":["attack.execution","attack.privilege-escalation","attack.persistence","attack.t1053.005"],"path":"rules/windows/builtin/security/win_security_susp_scheduled_task_creation.yml","techniques":["T1053.005"],"cves":[]},{"id":"3b8e5084-4de9-449a-a40d-0e11014f2e2d","title":"Diamond Sleet APT Scheduled Task Creation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"critical","date":"2023-10-24","modified":null,"description":"Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability\n","references":["https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/"],"logsource":{"product":"windows","service":"security"},"tags":["attack.execution","attack.privilege-escalation","attack.persistence","attack.t1053.005","detection.emerging-threats"],"path":"rules-emerging-threats/2023/TA/Diamond-Sleet/win_security_apt_diamond_sleet_scheduled_task.yml","techniques":["T1053.005"],"cves":[]},{"id":"3b92a1d0-8d4b-4d28-a1b4-1e29d49a6a3e","title":"Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location","author":"Swachchhanda Shrawan Poudel","status":"test","level":"low","date":"2024-09-02","modified":null,"description":"Detects the loading of the \"taskschd.dll\" module from a process that located in a potentially suspicious or uncommon directory.\nThe loading of this DLL might indicate that the application have the capability to create a scheduled task via the \"Schedule.Service\" COM object.\nInvestigation of the loading application and its behavior is required to determining if its malicious.\n","references":["https://www.logpoint.com/en/blog/shenanigans-of-scheduled-tasks/","https://x.com/Max_Mal_/status/1826179497084739829"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.persistence","attack.execution","attack.privilege-escalation","attack.t1053.005","detection.threat-hunting"],"path":"rules-threat-hunting/windows/image_load/image_load_dll_taskschd_by_process_in_potentially_suspicious_location.yml","techniques":["T1053.005"],"cves":[]},{"id":"424273ea-7cf8-43a6-b712-375f925e481f","title":"Scheduled Task Executed From A Suspicious Location","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-12-05","modified":"2023-02-07","description":"Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task","references":["Internal Research"],"logsource":{"product":"windows","service":"taskscheduler"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005"],"path":"rules/windows/builtin/taskscheduler/win_taskscheduler_execution_from_susp_locations.yml","techniques":["T1053.005"],"cves":[]},{"id":"4720b7df-40c3-48fd-bbdf-fd4b3c464f0d","title":"Scheduled TaskCache Change by Uncommon Program","author":"Syed Hasan (@syedhasan009)","status":"test","level":"high","date":"2021-06-18","modified":"2025-10-22","description":"Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious","references":["https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/","https://labs.f-secure.com/blog/scheduled-task-tampering/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053","attack.t1053.005"],"path":"rules/windows/registry/registry_set/registry_set_taskcache_entry.yml","techniques":["T1053","T1053.005"],"cves":[]},{"id":"4f86b304-3e02-40e3-aa5d-e88a167c9617","title":"Scheduled Task Deletion","author":"David Strassegger, Tim Shelton","status":"test","level":"low","date":"2021-01-22","modified":"2023-01-20","description":"Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \\TASKNAME","references":["https://twitter.com/matthewdunwoody/status/1352356685982146562","https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699"],"logsource":{"product":"windows","service":"security"},"tags":["attack.execution","attack.privilege-escalation","attack.persistence","car.2013-08-001","attack.t1053.005","detection.threat-hunting"],"path":"rules-threat-hunting/windows/builtin/security/win_security_scheduled_task_deletion.yml","techniques":["T1053.005"],"cves":[]},{"id":"53ba33fd-3a50-4468-a5ef-c583635cfa92","title":"OilRig APT Schedule Task Persistence - System","author":"Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community","status":"test","level":"critical","date":"2018-03-23","modified":"2023-03-08","description":"Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report","references":["https://web.archive.org/web/20180402134442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf"],"logsource":{"product":"windows","service":"system"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.defense-impairment","attack.g0049","attack.t1053.005","attack.s0111","attack.t1543.003","attack.t1112","attack.command-and-control","attack.t1071.004","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/OilRig/win_system_apt_oilrig_mar18.yml","techniques":["T1053.005","T1543.003","T1112","T1071.004"],"cves":[]},{"id":"56c217c3-2de2-479b-990f-5c109ba8458f","title":"HackTool - Default PowerSploit/Empire Scheduled Task Creation","author":"Markus Neis, @Karneades","status":"test","level":"high","date":"2018-03-06","modified":"2023-03-03","description":"Detects the creation of a schtask via PowerSploit or Empire Default Configuration.","references":["https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1","https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.s0111","attack.g0022","attack.g0060","car.2013-08-001","attack.t1053.005","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_powersploit_empire_default_schtasks.yml","techniques":["T1053.005","T1059.001"],"cves":[]},{"id":"614cf376-6651-47c4-9dcc-6b9527f749f4","title":"Suspicious Scheduled Task Update","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-05","modified":null,"description":"Detects update to a scheduled task event that contain suspicious keywords.","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"],"logsource":{"product":"windows","service":"security"},"tags":["attack.execution","attack.privilege-escalation","attack.persistence","attack.t1053.005"],"path":"rules/windows/builtin/security/win_security_susp_scheduled_task_update.yml","techniques":["T1053.005"],"cves":[]},{"id":"64a871dd-83f6-4e5f-80fc-5a7ca3a8a819","title":"Kapeka Backdoor Persistence Activity","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2024-07-03","modified":null,"description":"Detects Kapeka backdoor persistence activity.\nDepending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not).\nFor the scheduled task, it creates a scheduled task called \"Sens Api\" via schtasks command, which is set to run upon system startup as SYSTEM.\nTo establish persistence through the autorun utility, it adds an autorun entry called \"Sens Api\" under HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run via the \"reg add\" command.\nBoth persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.\n","references":["https://labs.withsecure.com/publications/kapeka","https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/","https://www.virustotal.com/gui/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Malware/kapeka/proc_creation_win_malware_kapeka_backdoor_persistence.yml","techniques":["T1053.005"],"cves":[]},{"id":"6c130acd-0adb-4545-bcc4-2e85d0883c9a","title":"Kapeka Backdoor Scheduled Task Creation","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2024-07-03","modified":null,"description":"Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.","references":["https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698","https://labs.withsecure.com/publications/kapeka","https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/","https://www.virustotal.com/gui/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f/behavior"],"logsource":{"product":"windows","service":"security"},"tags":["attack.execution","attack.privilege-escalation","attack.persistence","attack.t1053.005","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Malware/kapeka/win_security_malware_kapeka_backdoor_scheduled_task_creation.yml","techniques":["T1053.005"],"cves":[]},{"id":"73a883d0-0348-4be4-a8d8-51031c2564f8","title":"Potential Registry Persistence Attempt Via Windows Telemetry","author":"Lednyov Alexey, oscd.community, Sreeman","status":"test","level":"high","date":"2020-10-16","modified":"2023-08-17","description":"Detects potential persistence behavior using the windows telemetry registry key.\nWindows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections.\nThis binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run.\nThe problem is, it will run any arbitrary command without restriction of location or type.\n","references":["https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005"],"path":"rules/windows/registry/registry_set/registry_set_telemetry_persistence.yml","techniques":["T1053.005"],"cves":[]},{"id":"74ad4314-482e-4c3e-b237-3f7ed3b9ca8d","title":"Operation Wocao Activity - Security","author":"Florian Roth (Nextron Systems), frack113","status":"test","level":"high","date":"2019-12-20","modified":"2022-11-27","description":"Detects activity mentioned in Operation Wocao report","references":["https://web.archive.org/web/20200226212615/https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/","https://web.archive.org/web/20200226212615/https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf","https://twitter.com/SBousseaden/status/1207671369963646976"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.persistence","attack.discovery","attack.stealth","attack.t1012","attack.t1036.004","attack.t1027","attack.execution","attack.t1053.005","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/TA/Operation-Wocao/win_security_apt_wocao.yml","techniques":["T1012","T1036.004","T1027","T1053.005","T1059.001"],"cves":[]},{"id":"7595ba94-cf3b-4471-aa03-4f6baa9e5fad","title":"Important Scheduled Task Deleted/Disabled","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-05","modified":"2023-03-13","description":"Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4699","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4701"],"logsource":{"product":"windows","service":"security"},"tags":["attack.execution","attack.privilege-escalation","attack.persistence","attack.t1053.005"],"path":"rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml","techniques":["T1053.005"],"cves":[]},{"id":"7a02e22e-b885-4404-b38b-1ddc7e65258a","title":"Suspicious Schtasks Schedule Type With High Privileges","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-31","modified":null,"description":"Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_schedule_type_system.yml","techniques":["T1053.005"],"cves":[]},{"id":"7bdf2a7c-3acc-4091-9581-0a77dad1c5b5","title":"OilRig APT Registry Persistence","author":"Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community","status":"test","level":"critical","date":"2018-03-23","modified":"2023-03-08","description":"Detects OilRig registry persistence as reported by Nyotron in their March 2018 report","references":["https://web.archive.org/web/20180402134442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.defense-impairment","attack.g0049","attack.t1053.005","attack.s0111","attack.t1543.003","attack.t1112","attack.command-and-control","attack.t1071.004","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/OilRig/registry_event_apt_oilrig_mar18.yml","techniques":["T1053.005","T1543.003","T1112","T1071.004"],"cves":[]},{"id":"81325ce1-be01-4250-944f-b4789644556f","title":"Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-02-21","modified":"2025-10-07","description":"Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware","references":["https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/","https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04","https://blog.talosintelligence.com/gophish-powerrat-dcrat/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_env_folder.yml","techniques":["T1053.005"],"cves":[]},{"id":"86588b36-c6d3-465f-9cee-8f9093e07798","title":"Scheduled Task Executing Payload from Registry","author":"X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-07-18","modified":null,"description":"Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.","references":["https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_reg_loader.yml","techniques":["T1053.005","T1059.001"],"cves":[]},{"id":"89ca78fd-b37c-4310-b3d3-81a023f83936","title":"Schtasks Creation Or Modification With SYSTEM Privileges","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-28","modified":"2025-02-15","description":"Detects the creation or update of a scheduled task to run with \"NT AUTHORITY\\SYSTEM\" privileges","references":["https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_system.yml","techniques":["T1053.005"],"cves":[]},{"id":"8a8379b8-780b-4dbf-b1e9-31c8d112fefb","title":"Schtasks From Suspicious Folders","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-04-15","modified":"2022-11-18","description":"Detects scheduled task creations that have suspicious action command and folder combinations","references":["https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_folder_combos.yml","techniques":["T1053.005"],"cves":[]},{"id":"92626ddd-662c-49e3-ac59-f6535f12d189","title":"Scheduled Task Creation Via Schtasks.EXE","author":"Florian Roth (Nextron Systems)","status":"test","level":"low","date":"2019-01-16","modified":"2025-10-22","description":"Detects the creation of scheduled tasks by user accounts via the \"schtasks\" utility.","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.t1053.005","attack.s0111","car.2013-08-001","stp.1u"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_creation.yml","techniques":["T1053.005"],"cves":[]},{"id":"931b6802-d6a6-4267-9ffa-526f57f22aaf","title":"Potential BearLPE Exploitation","author":"Olaf Hartong","status":"test","level":"high","date":"2019-05-22","modified":"2023-01-26","description":"Detects potential exploitation of the BearLPE exploit using Task Scheduler \".job\" import arbitrary DACL write\\par","references":["https://github.com/djhohnstein/polarbearrepo/blob/f26d3e008093cc5c835e92a7165170baf6713d43/bearlpe/polarbear/polarbear/exploit.cpp"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.privilege-escalation","attack.t1053.005","car.2013-08-001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Exploits/BearLPE-Exploit/proc_creation_win_exploit_other_bearlpe.yml","techniques":["T1053.005"],"cves":[]},{"id":"93ff0ceb-e0ef-4586-8cd8-a6c277d738e3","title":"Scheduled Task Created - Registry","author":"Center for Threat Informed Defense (CTID) Summiting the Pyramid Team","status":"test","level":"low","date":"2023-09-27","modified":null,"description":"Detects the creation of a scheduled task via Registry keys.","references":["https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/task_scheduling/","https://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.s0111","attack.t1053.005","car.2013-08-001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/registry/registry_event/registry_event_scheduled_task_creation.yml","techniques":["T1053.005"],"cves":[]},{"id":"9494479d-d994-40bf-a8b1-eea890237021","title":"Scheduled Task Creation From Potential Suspicious Parent Location","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-02-23","modified":"2024-05-13","description":"Detects the execution of \"schtasks.exe\" from a parent that is located in a potentially suspicious location.\nMultiple malware strains were seen exhibiting a similar behavior in order to achieve persistence.\n","references":["https://app.any.run/tasks/649e7b46-9bec-4d05-98a5-dfa9a13eaae5/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.t1053.005","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_schtasks_creation_from_susp_parent.yml","techniques":["T1053.005"],"cves":[]},{"id":"958d81aa-8566-4cea-a565-59ccd4df27b0","title":"Defrag Deactivation","author":"Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)","status":"test","level":"medium","date":"2019-03-04","modified":"2022-10-09","description":"Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group","references":["https://securelist.com/apt-slingshot/84312/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.s0111","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/Slingshot/proc_creation_win_apt_slingshot.yml","techniques":["T1053.005"],"cves":[]},{"id":"970823b7-273b-460a-8afc-3a6811998529","title":"Uncommon One Time Only Scheduled Task At 00:00","author":"pH-T (Nextron Systems)","status":"test","level":"high","date":"2022-07-15","modified":"2023-02-03","description":"Detects scheduled task creation events that include suspicious actions, and is run once at 00:00","references":["https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_one_time_only_midnight_task.yml","techniques":["T1053.005"],"cves":[]},{"id":"9e2e51c5-c699-4794-ba5a-29f5da40ac0c","title":"Turla Group Commands May 2020","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-05-26","modified":"2025-10-19","description":"Detects commands used by Turla group as reported by ESET in May 2020","references":["https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.stealth","attack.g0010","attack.execution","attack.t1059.001","attack.t1053.005","attack.t1027","detection.emerging-threats"],"path":"rules-emerging-threats/2014/TA/Turla/proc_creation_win_apt_turla_comrat_may20.yml","techniques":["T1059.001","T1053.005","T1027"],"cves":[]},{"id":"9f8573c9-22b4-40e3-89c1-72bc2b8d49ab","title":"Scheduled Task Creation Masquerading as System Processes","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-02-05","modified":null,"description":"Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.","references":["https://tria.ge/241015-l98snsyeje/behavioral2"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.stealth","attack.t1053.005","attack.t1036.004","attack.t1036.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_system_process.yml","techniques":["T1053.005","T1036.004","T1036.005"],"cves":[]},{"id":"a762e74f-4dce-477c-b023-4ed81df600f9","title":"Scheduled Task Created - FileCreation","author":"Center for Threat Informed Defense (CTID) Summiting the Pyramid Team","status":"test","level":"low","date":"2023-09-27","modified":null,"description":"Detects the creation of a scheduled task via file creation.","references":["https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/task_scheduling/","https://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.t1053.005","attack.s0111","car.2013-08-001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/file/file_event/file_event_win_scheduled_task_creation.yml","techniques":["T1053.005"],"cves":[]},{"id":"a8f29a7b-b137-4446-80a0-b804272f3da2","title":"Persistence and Execution at Scale via GPO Scheduled Task","author":"Samir Bousseaden","status":"test","level":"high","date":"2019-04-03","modified":"2024-09-04","description":"Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale","references":["https://twitter.com/menasec1/status/1106899890377052160","https://www.secureworks.com/blog/ransomware-as-a-distraction","https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.lateral-movement","attack.t1053.005"],"path":"rules/windows/builtin/security/win_security_gpo_scheduledtasks.yml","techniques":["T1053.005"],"cves":[]},{"id":"b66474aa-bd92-4333-a16c-298155b120df","title":"Potential Persistence Via Powershell Search Order Hijacking - Task","author":"pH-T (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-04-08","modified":"2023-02-03","description":"Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader","references":["https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_powershell_persistence.yml","techniques":["T1053.005","T1059.001"],"cves":[]},{"id":"c0580559-a6bd-4ef6-b9b7-83703d98b561","title":"OilRig APT Schedule Task Persistence - Security","author":"Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community","status":"test","level":"critical","date":"2018-03-23","modified":"2023-03-08","description":"Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report","references":["https://web.archive.org/web/20180402134442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.defense-impairment","attack.g0049","attack.t1053.005","attack.s0111","attack.t1543.003","attack.t1112","attack.command-and-control","attack.t1071.004","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/OilRig/win_security_apt_oilrig_mar18.yml","techniques":["T1053.005","T1543.003","T1112","T1071.004"],"cves":[]},{"id":"c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78","title":"Scheduled Task Executing Encoded Payload from Registry","author":"pH-T (Nextron Systems), @Kostastsale, TheDFIRReport, X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-02-12","modified":"2023-02-04","description":"Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.","references":["https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_reg_loader_encoded.yml","techniques":["T1053.005","T1059.001"],"cves":[]},{"id":"c5c00f49-b3f9-45a6-997e-cfdecc6e1967","title":"Suspicious Schtasks Execution AppData Folder","author":"pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-03-15","modified":"2022-07-28","description":"Detects the creation of a schtask that executes a file from C:\\Users\\<USER>\\AppData\\Local","references":["https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_appdata_local_system.yml","techniques":["T1053.005","T1059.001"],"cves":[]},{"id":"ce6e34ca-966d-41c9-8d93-5b06c8b97a06","title":"OilRig APT Activity","author":"Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community","status":"test","level":"critical","date":"2018-03-23","modified":"2023-03-08","description":"Detects OilRig activity as reported by Nyotron in their March 2018 report","references":["https://web.archive.org/web/20180402134442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.defense-impairment","attack.g0049","attack.t1053.005","attack.s0111","attack.t1543.003","attack.t1112","attack.command-and-control","attack.t1071.004","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/OilRig/proc_creation_win_apt_oilrig_mar18.yml","techniques":["T1053.005","T1543.003","T1112","T1071.004"],"cves":[]},{"id":"d5eb7432-fda4-4bba-a37f-ffa74d9ed639","title":"Serpent Backdoor Payload Execution Via Scheduled Task","author":"@kostastsale","status":"test","level":"high","date":"2022-03-21","modified":null,"description":"Detects post exploitation execution technique of the Serpent backdoor.\nAccording to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.\nIt creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.\n","references":["https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.006","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Malware/Serpent-Backdoor/proc_creation_win_malware_serpent_backdoor_payload_execution.yml","techniques":["T1053.005","T1059.006"],"cves":[]},{"id":"dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c","title":"Suspicious Scheduled Task Creation via Masqueraded XML File","author":"Swachchhanda Shrawan Poudel, Elastic (idea)","status":"test","level":"medium","date":"2023-04-20","modified":"2024-12-01","description":"Detects the creation of a scheduled task using the \"-XML\" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence","references":["https://learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-","https://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.stealth","attack.t1036.005","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml","techniques":["T1036.005","T1053.005"],"cves":[]},{"id":"e1118a8f-82f5-44b3-bb6b-8a284e5df602","title":"Potential ACTINIUM Persistence Activity","author":"Andreas Hunkeler (@Karneades)","status":"test","level":"high","date":"2022-02-07","modified":"2023-03-18","description":"Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.","references":["https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053","attack.t1053.005","detection.emerging-threats"],"path":"rules-emerging-threats/2022/TA/ACTINIUM/proc_creation_win_apt_actinium_persistence.yml","techniques":["T1053","T1053.005"],"cves":[]},{"id":"f0767f15-0fb3-44b9-851e-e8d9a6d0005d","title":"Scheduled Task Executed Uncommon LOLBIN","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-12-05","modified":"2023-02-07","description":"Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task","references":["Internal Research"],"logsource":{"product":"windows","service":"taskscheduler"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005"],"path":"rules/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml","techniques":["T1053.005"],"cves":[]},{"id":"f2c64357-b1d2-41b7-849f-34d2682c0fad","title":"Suspicious Command Patterns In Scheduled Task Creation","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-23","modified":"2024-03-19","description":"Detects scheduled task creation using \"schtasks\" that contain potentially suspicious or uncommon commands","references":["https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/","https://twitter.com/RedDrip7/status/1506480588827467785","https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_susp_pattern.yml","techniques":["T1053.005"],"cves":[]},{"id":"f548a603-c9f2-4c89-b511-b089f7e94549","title":"Potential Persistence Via Microsoft Compatibility Appraiser","author":"Sreeman","status":"test","level":"medium","date":"2020-09-29","modified":"2023-02-10","description":"Detects manual execution of the \"Microsoft Compatibility Appraiser\" task via schtasks.\nIn order to trigger persistence stored in the \"\\AppCompatFlags\\TelemetryController\" registry key.\n","references":["https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_persistence_windows_telemetry.yml","techniques":["T1053.005"],"cves":[]},{"id":"f91e51c9-f344-4b32-969b-0b6f6b8537d4","title":"Renamed Schtasks Execution","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-27","modified":null,"description":"Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks.\nOne of the very common persistence techniques is schedule malicious tasks using schtasks.exe.\nSince, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.\n","references":["https://x.com/JangPr0/status/1932034543026065833","https://ss64.com/nt/schtasks.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1036.003","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_renamed_schtasks_execution.yml","techniques":["T1036.003","T1053.005"],"cves":[]},{"id":"ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b","title":"Suspicious Scheduled Task Name As GUID","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-10-31","modified":null,"description":"Detects creation of a scheduled task with a GUID like name","references":["https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/","https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1053.005"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_guid_task_name.yml","techniques":["T1053.005"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2023-46604","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-34473","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}