Scheduled Tasks

Task Registration, Update, and Enablement Audits #

Task creation, update, and enablement records select different lifecycle operations.

• Diamond Sleet APT Scheduled Task Creation Sigma

  Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

• Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor Sigma

  Hunts for known SVR-specific scheduled task names

TaskCache Registry Activity #

Rules select new TaskCache entries and registry changes that can hide scheduled tasks from Task Scheduler.

No rules currently have sufficient source evidence for selection in this section.

Task Definition File Activity #

Rules select task definition file activity under System32\Tasks or legacy Windows\Tasks paths.

No rules currently have sufficient source evidence for selection in this section.

Legacy AT Jobs and Configuration #

Rules select legacy scheduled job configuration and related activity. Registry changes do not establish that a job was created or run.

No rules currently have sufficient source evidence for selection in this section.

Task Execution and Operational Events #

These rules detect task actions and processes launched by Task Scheduler.

No rules currently have sufficient source evidence for selection in this section.

Task Deletion and Disablement Audits #

Rules select deleted or disabled tasks by name.

• Defrag Deactivation - Security Sigma

  Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

• Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor Sigma

  Hunts for known SVR-specific scheduled task names

Schtasks Command Requests #

Rules select local and remote schtasks commands.

• Defrag Deactivation Sigma

  Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

• Delete All Scheduled Tasks Sigma

  Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

• HackTool - Default PowerSploit/Empire Scheduled Task Creation Sigma

  Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

• Potential KamiKakaBot Activity - Shutdown Schedule Task Creation Sigma

  Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command. This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.

• Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE Sigma

  Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware

• Scheduled Task Creation From Potential Suspicious Parent Location Sigma

  Detects the execution of "schtasks.exe" from a parent that is located in a potentially suspicious location. Multiple malware strains were seen exhibiting a similar behavior in order to achieve persistence.

• Scheduled Task Creation Via Schtasks.EXE Sigma

  Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.

• Scheduled Task Creation with Curl and PowerShell Execution Combo Sigma

  Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them. This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.

• Schtasks Creation Or Modification With SYSTEM Privileges Sigma

  Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

• Suspicious Command Patterns In Scheduled Task Creation Sigma

  Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

• Suspicious Modification Of Scheduled Tasks Sigma

  Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

• Suspicious Scheduled Task Creation Involving Temp Folder Sigma

  Detects the creation of scheduled tasks that involves a temporary folder and runs only once

• Suspicious Scheduled Task Name As GUID Sigma

  Detects creation of a scheduled task with a GUID like name

• Suspicious Schtasks Execution AppData Folder Sigma

  Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local

PowerShell Task Requests #

Rules select PowerShell script text naming task cmdlets or Win32_ScheduledJob.

• Powershell Create Scheduled Task Sigma

  Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code

Task Correlations and Access Checks #

Rules correlate task activity or select ATSVC pipe access.

No rules currently have sufficient source evidence for selection in this section.

Mixed Task and Process Context #

Rules combine task activity with process context or accept either form of evidence.

No rules currently have sufficient source evidence for selection in this section.

GPO Changes and Task File Access Checks #

Rules select Group Policy task changes or access checks for ScheduledTasks.xml in SYSVOL.

No rules currently have sufficient source evidence for selection in this section.