Suspicious Command Patterns In Scheduled Task Creation

Severity: high
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `selection_schtasks`

CommandLine|contains: '/Create '
Image|endswith: '\schtasks.exe'

Stage 2: `all of selection_pattern_1`

or:
CommandLine|contains: '/ru system '
CommandLine|contains: '/sc minute '

Stage 3: `all of selection_pattern_2`

or:
CommandLine|contains: 'cmd /c'
CommandLine|contains: 'cmd /k'
CommandLine|contains: 'cmd /r'
CommandLine|contains: 'cmd.exe /c '
CommandLine|contains: 'cmd.exe /k '
CommandLine|contains: 'cmd.exe /r '

Stage 4: `selection_uncommon`

or:
CommandLine|contains: ' -decode '
CommandLine|contains: ' -enc '
CommandLine|contains: ' -w hidden '
CommandLine|contains: ' IEX'
CommandLine|contains: ' bypass '
CommandLine|contains: .DownloadData
CommandLine|contains: .DownloadFile
CommandLine|contains: .DownloadString
CommandLine|contains: '/c start /min '
CommandLine|contains: FromBase64String
CommandLine|contains: 'mshta http'
CommandLine|contains: 'mshta.exe http'

Stage 5: `all of selection_anomaly_1`

or:
CommandLine|contains: '%AppData%'
CommandLine|contains: '%Temp%'
CommandLine|contains: '%tmp%'
CommandLine|contains: ':\ProgramData\'
CommandLine|contains: ':\Temp\'
CommandLine|contains: ':\Tmp\'
CommandLine|contains: ':\Users\Public\'
CommandLine|contains: ':\Windows\Temp\'
CommandLine|contains: '\AppData\'

Stage 6: `all of selection_anomaly_2`

or:
CommandLine|contains: cscript
CommandLine|contains: curl
CommandLine|contains: wscript

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`-decode` corpus 4 (sigma 4) `-enc` corpus 6 (sigma 6) `-w hidden` corpus 3 (sigma 3) `IEX` `bypass` `%AppData%` corpus 7 (sigma 7) `%Temp%` corpus 4 (sigma 4) `%tmp%` corpus 9 (sigma 9) `.DownloadData` `.DownloadFile` corpus 2 (sigma 2) `.DownloadString` corpus 2 (sigma 2) `/Create` corpus 2 (sigma 2) `/c start /min` `/ru system` `/sc minute` `:\ProgramData\` corpus 5 (sigma 5) `:\Temp\` corpus 14 (sigma 14) `:\Tmp\` corpus 2 (sigma 2) `:\Users\Public\` corpus 14 (sigma 14) `:\Windows\Temp\` corpus 15 (sigma 15) `FromBase64String` corpus 7 (sigma 7) `\AppData\` corpus 8 (sigma 8) `cmd /c` corpus 4 (sigma 4) `cmd /k` corpus 3 (sigma 3) `cmd /r` corpus 3 (sigma 3) `cmd.exe /c` corpus 6 (sigma 6) `cmd.exe /k` corpus 6 (sigma 6) `cmd.exe /r` corpus 6 (sigma 6) `cscript` corpus 12 (sigma 12) `curl` corpus 3 (sigma 3) `mshta http` `mshta.exe http` `wscript` corpus 12 (sigma 12)
`Image`	ends_with	`\schtasks.exe` corpus 45 (sigma 45)

Suspicious Command Patterns In Scheduled Task Creation

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: selection_schtasks

Stage 2: all of selection_pattern_1

Stage 3: all of selection_pattern_2

Stage 4: selection_uncommon

Stage 5: all of selection_anomaly_1