Detection rules › Sigma

Renamed Schtasks Execution

Severity
high
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
upstream

Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks. One of the very common persistence techniques is schedule malicious tasks using schtasks.exe. Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1053.005 Scheduled Task/Job: Scheduled Task
PersistenceT1053.005 Scheduled Task/Job: Scheduled Task
Privilege EscalationT1053.005 Scheduled Task/Job: Scheduled Task
Defense EvasionT1036.003 Masquerading: Rename Legitimate Utilities

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_cmd_operation

or:
CommandLine|contains: ' /change '
CommandLine|contains: ' /create '
CommandLine|contains: ' /delete '
CommandLine|contains: ' /end '
CommandLine|contains: ' /query '
CommandLine|contains: ' /run '

Stage 2: all of selection_cmd_flags

or:
CommandLine|contains: ' /fo '
CommandLine|contains: ' /ru '
CommandLine|contains: ' /sc '
CommandLine|contains: ' /st '
CommandLine|contains: ' /tn '
CommandLine|contains: ' /tr '

Stage 3: not filter_main_cmd

CommandLine|contains: schtasks

Stage 4: selection_pe

OriginalFileName: schtasks.exe

Stage 5: not filter_main_img

Image|endswith: '\schtasks.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /change corpus 2 (sigma 2)
  • /create corpus 14 (sigma 14)
  • /delete corpus 2 (sigma 2)
  • /end
  • /fo
  • /query
  • /ru
  • /run
  • /sc
  • /st
  • /tn
  • /tr
  • schtasks corpus 3 (sigma 3)
Imageends_with
  • \schtasks.exe corpus 45 (sigma 45)
OriginalFileNameeq
  • schtasks.exe corpus 14 (sigma 14)