Detection rules › Sigma

Suspicious Schtasks Execution AppData Folder

Severity
high
Author
pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects the creation of a schtask that executes a file from C:\Users<USER>\AppData\Local

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1053.005 Scheduled Task/Job: Scheduled Task, T1059.001 Command and Scripting Interpreter: PowerShell
PersistenceT1053.005 Scheduled Task/Job: Scheduled Task
Privilege EscalationT1053.005 Scheduled Task/Job: Scheduled Task

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: selection

or:
CommandLine|contains: ' SYSTEM '
CommandLine|contains: 'NT AUT'
CommandLine|contains: '/Create'
CommandLine|contains: '/RU'
CommandLine|contains: '/TR'
CommandLine|contains: 'C:\Users\'
CommandLine|contains: '\AppData\Local\'
Image|endswith: '\schtasks.exe'

Stage 2: not filter

CommandLine|contains: '/TN TVInstallRestore'
Image|endswith: '\schtasks.exe'
ParentImage|contains: TeamViewer_.exe
ParentImage|contains: '\AppData\Local\Temp\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • SYSTEM corpus 2 (sigma 2)
  • /Create corpus 4 (sigma 4)
  • /RU
  • /TN TVInstallRestore corpus 2 (sigma 2)
  • /TR
  • C:\Users\ corpus 5 (sigma 5)
  • NT AUT corpus 4 (sigma 4)
  • \AppData\Local\ corpus 8 (sigma 8)
Imageends_with
  • \schtasks.exe corpus 45 (sigma 45)
ParentImagematch
  • TeamViewer_.exe
  • \AppData\Local\Temp\ corpus 4 (sigma 4)