LoFP LoFP / legitimate system administration tasks scheduling trusted system processes.

Techniques

Sample rules

Scheduled Task Creation Masquerading as System Processes

Description

Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.

Detection logic

condition: all of selection_*
selection_cli:
  CommandLine|contains:
  - ' audiodg'
  - ' conhost'
  - ' dwm.exe'
  - ' explorer'
  - ' lsass'
  - ' lsm'
  - ' mmc'
  - ' msiexec'
  - ' regsvr32'
  - ' rundll32'
  - ' services'
  - ' spoolsv'
  - ' svchost'
  - ' taskeng'
  - ' taskhost'
  - ' wininit'
  - ' winlogon'
  CommandLine|contains|windash: ' /create '
selection_img:
- Image|endswith: \schtasks.exe
- OriginalFileName: schtasks.exe