Scheduled Task Creation Masquerading as System Processes

Title: Scheduled Task Creation Masquerading as System Processes
Status: experimental
Description:Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.
References:
  -https://tria.ge/241015-l98snsyeje/behavioral2
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-02-05
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.persistence'
• -'attack.stealth'
• -'attack.t1053.005'
• -'attack.t1036.004'
• -'attack.t1036.005'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\schtasks.exe' OriginalFileName:'schtasks.exe'   selection_cli:
    CommandLine|contains|windash: ' /create '
    CommandLine|contains:
      -' audiodg'
      -' conhost'
      -' dwm.exe'
      -' explorer'
      -' lsass'
      -' lsm'
      -' mmc'
      -' msiexec'
      -' regsvr32'
      -' rundll32'
      -' services'
      -' spoolsv'
      -' svchost'
      -' taskeng'
      -' taskhost'
      -' wininit'
      -' winlogon'

  condition:all of selection_*
Falsepositives:
  -Legitimate system administration tasks scheduling trusted system processes.
Level: high