Scheduled Task Creation Via Schtasks.EXE

Title: Scheduled Task Creation Via Schtasks.EXE
Status: test
Description:Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.
References:
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
Author: Florian Roth (Nextron Systems)
Date: 2019-01-16
modified:2025-10-22
Tags:

• -'attack.execution'
• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1053.005'
• -'attack.s0111'
• -'car.2013-08-001'
• -'stp.1u'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains: ' /create '
  filter_main_system_user:
    User|contains:
      -'AUTHORI'
      -'AUTORI'

  filter_optional_msoffice:
    ParentImage:
      -'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
      -'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'

    Image:
      -'C:\Windows\System32\schtasks.exe'
      -'C:\Windows\SysWOW64\schtasks.exe'

    CommandLine|contains: 'Microsoft\Office\Office Performance Monitor'
  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Administrative activity
  -Software installation
Level: low