detection.wiki

Detection rules › Sigma

Potential SSH Tunnel Persistence Install Using A Scheduled Task

Status
experimental
Severity
high
Log source
product windows, category process_creation
Author
Rory Duncan
Source
github.com/SigmaHQ/sigma

Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1053.005 Scheduled Task/Job: Scheduled Task
PersistenceT1053.005 Scheduled Task/Job: Scheduled Task
Privilege EscalationT1053.005 Scheduled Task/Job: Scheduled Task

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Potential SSH Tunnel Persistence Install Using A Scheduled Task
id: 2daa93a0-a5fb-41c5-8cd8-3c11294bfd1f
status: experimental
description: Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.
references:
    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
    - https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection
author: Rory Duncan
date: 2025-07-14
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.t1053.005
    - attack.command-and-control
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\schtasks.exe'
        - OriginalFileName: 'schtasks.exe'
    selection_cli_sshd:
        CommandLine|contains|all:
            - ' /create '
            - 'sshd.exe'
            - '-f'
    selection_cli_ssh:
        CommandLine|contains|all:
            - ' /create '
            - 'ssh.exe'
            - '-i'
    condition: selection_img and 1 of selection_cli_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection_img and 1 of selection_cli_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\schtasks.exe'
    - OriginalFileName: 'schtasks.exe'

Stage 2: selection_cli_sshd

selection_cli_sshd:
    CommandLine|contains|all:
        - ' /create '
        - 'sshd.exe'
        - '-f'

Stage 3: selection_cli_ssh

selection_cli_ssh:
    CommandLine|contains|all:
        - ' /create '
        - 'ssh.exe'
        - '-i'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /create corpus 15 (sigma 15)
  • -f corpus 9 (sigma 7, splunk 2)
  • -i corpus 7 (sigma 7)
  • ssh.exe
  • sshd.exe
Imageends_with
  • \schtasks.exe corpus 56 (sigma 56)
OriginalFileNameeq
  • schtasks.exe corpus 23 (sigma 18, splunk 4, elastic 1)