Scheduled Task Creation Masquerading as System Processes

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.

Known false positives

Legitimate system administration tasks scheduling trusted system processes.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task
Stealth	`T1036.004` Masquerading: Masquerade Task or Service `T1036.005` Masquerading: Match Legitimate Resource Name or Location

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Scheduled Task Creation Masquerading as System Processes
id: 9f8573c9-22b4-40e3-89c1-72bc2b8d49ab
status: experimental
description: Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.
references:
    - https://tria.ge/241015-l98snsyeje/behavioral2
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-02-05
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.stealth
    - attack.t1053.005
    - attack.t1036.004
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\schtasks.exe'
        - OriginalFileName: 'schtasks.exe'
    selection_cli:
        CommandLine|contains|windash: ' /create '
        CommandLine|contains:
            - ' audiodg'
            - ' conhost'
            - ' dwm.exe'
            - ' explorer'
            - ' lsass'
            - ' lsm'
            - ' mmc'
            - ' msiexec'
            - ' regsvr32'
            - ' rundll32'
            - ' services'
            - ' spoolsv'
            - ' svchost'
            - ' taskeng'
            - ' taskhost'
            - ' wininit'
            - ' winlogon'
    condition: all of selection_*
falsepositives:
    - Legitimate system administration tasks scheduling trusted system processes.
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\schtasks.exe'
    - OriginalFileName: 'schtasks.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|windash: ' /create '
    CommandLine|contains:
        - ' audiodg'
        - ' conhost'
        - ' dwm.exe'
        - ' explorer'
        - ' lsass'
        - ' lsm'
        - ' mmc'
        - ' msiexec'
        - ' regsvr32'
        - ' rundll32'
        - ' services'
        - ' spoolsv'
        - ' svchost'
        - ' taskeng'
        - ' taskhost'
        - ' wininit'
        - ' winlogon'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/create` transforms: `windash` corpus 15 (sigma 15) `audiodg` `conhost` `dwm.exe` `explorer` `lsass` `lsm` `mmc` `msiexec` corpus 2 (sigma 2) `regsvr32` `rundll32` corpus 3 (sigma 2, splunk 1) `services` `spoolsv` `svchost` `taskeng` `taskhost` `wininit` `winlogon`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\schtasks.exe` corpus 55 (sigma 55)	`field:"Image" kind:ends_with value:"\schtasks.exe"`
`OriginalFileName`	eq	`schtasks.exe` corpus 31 (sigma 18, elastic 9, splunk 4)	`field:"OriginalFileName" kind:eq value:"schtasks.exe"`