Scheduled Task/Job: Scheduled Task T1053.005

Events covered

25 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 118 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (63 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (1134 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (168 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 58 rules

• ChromeLoader Malware Execution
• Defrag Deactivation
• Diamond Sleet APT Scheduled Task Creation
• Fortinet APT group abuse on Windows (task)
• HackTool - Default PowerSploit/Empire Scheduled Task Creation
• Important Scheduled Task Deleted/Disabled
• Interactive privileged shell triggered by schedule task (deprecated)
• Kapeka Backdoor Persistence Activity
• Kapeka Backdoor Scheduled Task Creation
• Massive remote schedule task creation via named pipes (CrackMapExec with ATexec)
• OilRig APT Activity
• OilRig APT Registry Persistence
• OilRig APT Schedule Task Persistence - Security
• OilRig APT Schedule Task Persistence - System
• Operation Wocao Activity
• Operation Wocao Activity - Security
• Persistence and Execution at Scale via GPO Scheduled Task
• Potential ACTINIUM Persistence Activity
• Potential BearLPE Exploitation
• Potential Persistence Via Microsoft Compatibility Appraiser
• Potential Persistence Via Powershell Search Order Hijacking - Task
• Potential Registry Persistence Attempt Via Windows Telemetry
• Potential SSH Tunnel Persistence Install Using A Scheduled Task
• Powershell Create Scheduled Task
• Remote schedule task creation via named pipes (ATexec)
• Renamed Schtasks Execution
• Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
• Scheduled persistent task with SYSTEM privileges creation
• Scheduled Task Created - FileCreation
• Scheduled Task Created - Registry
• Scheduled task created and deleted fastly (ATexec.py)
• Scheduled Task Creation From Potential Suspicious Parent Location
• Scheduled Task Creation Masquerading as System Processes
• Scheduled Task Creation Via Schtasks.EXE
• Scheduled task creation with command line
• Scheduled Task Creation with Curl and PowerShell Execution Combo
• Scheduled Task Deletion
• Scheduled Task Executed From A Suspicious Location
• Scheduled Task Executed Uncommon LOLBIN
• Scheduled Task Executing Encoded Payload from Registry
• Scheduled Task Executing Payload from Registry
• Scheduled TaskCache Change by Uncommon Program
• Schtasks Creation Or Modification With SYSTEM Privileges
• Schtasks From Suspicious Folders
• Serpent Backdoor Payload Execution Via Scheduled Task
• Suspicious Command Patterns In Scheduled Task Creation
• Suspicious Modification Of Scheduled Tasks
• Suspicious Scheduled Task Creation
• Suspicious Scheduled Task Creation Involving Temp Folder
• Suspicious Scheduled Task Creation via Masqueraded XML File
• Suspicious Scheduled Task Name As GUID
• Suspicious Scheduled Task Update
• Suspicious Schtasks Execution AppData Folder
• Suspicious Schtasks Schedule Type With High Privileges
• Suspicious Schtasks Schedule Types
• Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location
• Turla Group Commands May 2020
• Uncommon One Time Only Scheduled Task At 00:00

Elastic 19 rules

• A scheduled task was created
• At.exe Command Lateral Movement
• Creation or Modification of a new GPO Scheduled Task or Service
• Local Scheduled Task Creation
• Outbound Scheduled Task Activity via PowerShell
• Persistence via a Windows Installer
• Persistence via Scheduled Job Creation
• Persistence via TelemetryController Scheduled Task Hijack
• Potential PowerShell HackTool Script by Function Names
• Remote Scheduled Task Creation
• Remote Scheduled Task Creation via RPC
• Scheduled Task Created by a Windows Script
• Scheduled Task Execution at Scale via GPO
• Suspicious Execution via Scheduled Task
• Suspicious Image Load (taskschd.dll) from MS Office
• Suspicious ScreenConnect Client Child Process
• Temporarily Scheduled Task Creation
• UAC Bypass via DiskCleanup Scheduled Task Hijack
• Unusual Scheduled Task Update

Splunk 35 rules

• Create_Modify Schtasks (PowerShell)
• Create_Modify Schtasks (Sysmon)
• Create_Modify Schtasks (Windows Event Log)
• Impacket atexec.py Execution (PowerShell)
• Impacket atexec.py Execution (Sysmon)
• Impacket atexec.py Execution (Windows Event Log)
• Impacket atexec.py Scheduled Task Creation (Windows Event Log)
• Impacket atexec.py Temp File Creation (Sysmon)
• Impacket atexec.py Temp File Creation (Windows Event Log)
• Possible Lateral Movement PowerShell Spawn
• Randomly Generated Scheduled Task Name
• Rare Schedule Task Created (Windows Event Log)
• Rare Scheduled Task (Windows Event Log)
• Scheduled Task Deleted Or Created via CMD
• Scheduled Task Initiation on Remote Endpoint
• Schtasks scheduling job on remote system
• Schtasks used for forcing a reboot
• Short Lived Scheduled Task
• Suspicious Scheduled Task from Public Directory
• Svchost LOLBAS Execution Process Spawn
• Windows Compatibility Telemetry Suspicious Child Process
• Windows Compatibility Telemetry Tampering Through Registry
• Windows Enable Win32 ScheduledJob via Registry
• Windows PowerShell ScheduleTask
• Windows Registry Delete Task SD
• Windows Scheduled Task Created in a Group Policy Object
• Windows Scheduled Task Created Via XML
• Windows Scheduled Task Service Spawned Shell
• Windows Scheduled Task with Highest Privileges
• Windows Scheduled Task with Suspicious Command
• Windows Scheduled Task with Suspicious Name
• Windows Schtasks Create Run As System
• WinEvent Scheduled Task Created to Spawn Shell
• WinEvent Scheduled Task Created Within Public Path
• WinEvent Windows Task Scheduler Event Action Started

Kusto 4 rules

• Detect Rare scheduled task created
• Detect Unsigned executable launch from scheduled task
• Persistence Via Scheduled Tasks
• Powershell Empire Cmdlets Executed in Command Line

YARA-L 1 rule

• MITRE ATT&CK T1053.005 Windows Creation Of Scheduled Task

Panther 1 rule

• Azure Automation Schedule Created or Modified