Techniques
Sample rules
Scheduled Task Creation Masquerading as System Processes
- source: sigma
- technicques:
- t1036
- t1036.004
- t1036.005
- t1053
- t1053.005
Description
Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.
Detection logic
condition: all of selection_*
selection_cli:
CommandLine|contains:
- ' audiodg'
- ' conhost'
- ' dwm.exe'
- ' explorer'
- ' lsass'
- ' lsm'
- ' mmc'
- ' msiexec'
- ' regsvr32'
- ' rundll32'
- ' services'
- ' spoolsv'
- ' svchost'
- ' taskeng'
- ' taskhost'
- ' wininit'
- ' winlogon'
CommandLine|contains|windash: ' /create '
selection_img:
- Image|endswith: \schtasks.exe
- OriginalFileName: schtasks.exe