Powershell Create Scheduled Task

Status: test
Severity: medium
Log source: category ps_script, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: Powershell Create Scheduled Task
id: 363eccc0-279a-4ccf-a3ab-24c2e63b11fb
status: test
description: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-4---powershell-cmdlet-scheduled-task
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-6---wmi-invoke-cimmethod-scheduled-task
author: frack113
date: 2021-12-28
modified: 2025-10-07
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_cmdlet:
        ScriptBlockText|contains:
            - 'New-ScheduledTaskAction'
            - 'New-ScheduledTaskTrigger'
            - 'New-ScheduledTaskPrincipal'
            - 'New-ScheduledTaskSettingsSet'
            - 'New-ScheduledTask'
            - 'Register-ScheduledTask'
    selection_cimmethod:
        ScriptBlockText|contains|all:
            - 'Invoke-CimMethod'
            - '-ClassName'
            - 'PS_ScheduledTask'
            - '-NameSpace'
            - 'Root\Microsoft\Windows\TaskScheduler'
    filter_main_legitimate_scripts:
        ScriptBlockText|contains|all:
            - 'Microsoft.PowerShell.Core\Export-ModuleMember'
            - 'Microsoft.Management.Infrastructure.CimInstance'
            - '__cmdletization_methodParameter'
    condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection_* and not 1 of filter_main_*

Stage 1: `selection_cmdlet`

selection_cmdlet:
    ScriptBlockText|contains:
        - 'New-ScheduledTaskAction'
        - 'New-ScheduledTaskTrigger'
        - 'New-ScheduledTaskPrincipal'
        - 'New-ScheduledTaskSettingsSet'
        - 'New-ScheduledTask'
        - 'Register-ScheduledTask'

Stage 2: `selection_cimmethod`

selection_cimmethod:
    ScriptBlockText|contains|all:
        - 'Invoke-CimMethod'
        - '-ClassName'
        - 'PS_ScheduledTask'
        - '-NameSpace'
        - 'Root\Microsoft\Windows\TaskScheduler'

Stage 3: `not filter_main_legitimate_scripts`

filter_main_legitimate_scripts:
    ScriptBlockText|contains|all:
        - 'Microsoft.PowerShell.Core\Export-ModuleMember'
        - 'Microsoft.Management.Infrastructure.CimInstance'
        - '__cmdletization_methodParameter'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ScriptBlockText`	match	`Microsoft.Management.Infrastructure.CimInstance`	`excludes:ScriptBlockText` `field:"ScriptBlockText" value:"Microsoft.Management.Infrastructure.CimInstance"`
`ScriptBlockText`	match	`Microsoft.PowerShell.Core\Export-ModuleMember`	`excludes:ScriptBlockText` `field:"ScriptBlockText" value:"Microsoft.PowerShell.Core\Export-ModuleMember"`
`ScriptBlockText`	match	`__cmdletization_methodParameter`	`excludes:ScriptBlockText` `field:"ScriptBlockText" value:"__cmdletization_methodParameter"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`-ClassName` `-NameSpace` corpus 2 (sigma 1, splunk 1) `Invoke-CimMethod` `New-ScheduledTask` `New-ScheduledTaskAction` `New-ScheduledTaskPrincipal` `New-ScheduledTaskSettingsSet` `New-ScheduledTaskTrigger` `PS_ScheduledTask` `Register-ScheduledTask` `Root\Microsoft\Windows\TaskScheduler`	`field:"ScriptBlockText" kind:match`