Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE

Hunt Hypothesis

Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware

Detection Rule

Sigma (Original)

title: Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
id: 81325ce1-be01-4250-944f-b4789644556f
related:
    - id: 43f487f0-755f-4c2a-bce7-d6d2eec2fcf8 # TODO: Recreate after baseline
      type: derived
status: test
description: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware
references:
    - https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/
    - https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04
    - https://blog.talosintelligence.com/gophish-powerrat-dcrat/
author: Florian Roth (Nextron Systems)
date: 2022-02-21
modified: 2025-10-07
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.t1053.005
logsource:
    product: windows
    category: process_creation
detection:
    selection_1_create:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains|windash: ' /create '
    selection_1_all_folders:
        CommandLine|contains:
            - ':\Perflogs'
            - ':\Users\All Users\'
            - ':\Users\Default\'
            - ':\Users\Public'
            - ':\Windows\Temp'
            - '\AppData\Local\'
            - '\AppData\Roaming\'
            - '%AppData%'
            - '%Public%'
    selection_2_parent:
        ParentCommandLine|endswith: '\svchost.exe -k netsvcs -p -s Schedule'
    selection_2_some_folders:
        CommandLine|contains:
            - ':\Perflogs'
            - ':\Windows\Temp'
            - '\Users\Public'
            - '%Public%'
    filter_optional_other:
        - ParentCommandLine|contains: 'unattended.ini'
        - CommandLine|contains: 'update_task.xml'
    filter_optional_team_viewer:
        CommandLine|contains: '/Create /TN TVInstallRestore /TR'
    filter_optional_avira_install:
        # Comment out this filter if you dont use AVIRA
        CommandLine|contains|all:
            - '/Create /Xml '
            - '\Temp\.CR.'
            - '\Avira_Security_Installation.xml'
    filter_optional_avira_other:
        # Comment out this filter if you dont use AVIRA
        CommandLine|contains|all:
            - '/Create /F /TN'
            - '/Xml '
            - '\Temp\'
            - 'Avira_'
        CommandLine|contains:
            - '.tmp\UpdateFallbackTask.xml'
            - '.tmp\WatchdogServiceControlManagerTimeout.xml'
            - '.tmp\SystrayAutostart.xml'
            - '.tmp\MaintenanceTask.xml'
    filter_optional_klite_codec:
        CommandLine|contains|all:
            - '\Temp\'
            - '/Create /TN "klcp_update" /XML '
            - '\klcp_update_task.xml'
    condition: ( all of selection_1_* or all of selection_2_* ) and not 1 of filter_optional_*
falsepositives:
    - Benign scheduled tasks creations or executions that happen often during software installations
    - Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders
level: medium

KQL (Azure Sentinel)

imProcessCreate
| where (((TargetProcessName endswith "\\schtasks.exe" and (TargetProcessCommandLine contains " -create " or TargetProcessCommandLine contains " /create " or TargetProcessCommandLine contains " –create " or TargetProcessCommandLine contains " —create " or TargetProcessCommandLine contains " ―create ")) and (TargetProcessCommandLine contains ":\\Perflogs" or TargetProcessCommandLine contains ":\\Users\\All Users\\" or TargetProcessCommandLine contains ":\\Users\\Default\\" or TargetProcessCommandLine contains ":\\Users\\Public" or TargetProcessCommandLine contains ":\\Windows\\Temp" or TargetProcessCommandLine contains "\\AppData\\Local\\" or TargetProcessCommandLine contains "\\AppData\\Roaming\\" or TargetProcessCommandLine contains "%AppData%" or TargetProcessCommandLine contains "%Public%")) or (ActingProcessCommandLine endswith "\\svchost.exe -k netsvcs -p -s Schedule" and (TargetProcessCommandLine contains ":\\Perflogs" or TargetProcessCommandLine contains ":\\Windows\\Temp" or TargetProcessCommandLine contains "\\Users\\Public" or TargetProcessCommandLine contains "%Public%"))) and (not(((ActingProcessCommandLine contains "unattended.ini" or TargetProcessCommandLine contains "update_task.xml") or TargetProcessCommandLine contains "/Create /TN TVInstallRestore /TR" or (TargetProcessCommandLine contains "/Create /Xml " and TargetProcessCommandLine contains "\\Temp\\.CR." and TargetProcessCommandLine contains "\\Avira_Security_Installation.xml") or ((TargetProcessCommandLine contains "/Create /F /TN" and TargetProcessCommandLine contains "/Xml " and TargetProcessCommandLine contains "\\Temp\\" and TargetProcessCommandLine contains "Avira_") and (TargetProcessCommandLine contains ".tmp\\UpdateFallbackTask.xml" or TargetProcessCommandLine contains ".tmp\\WatchdogServiceControlManagerTimeout.xml" or TargetProcessCommandLine contains ".tmp\\SystrayAutostart.xml" or TargetProcessCommandLine contains ".tmp\\MaintenanceTask.xml")) or (TargetProcessCommandLine contains "\\Temp\\" and TargetProcessCommandLine contains "/Create /TN \"klcp_update\" /XML " and TargetProcessCommandLine contains "\\klcp_update_task.xml"))))

Required Data Sources

False Positive Guidance

• Benign scheduled tasks creations or executions that happen often during software installations
• Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders

MITRE ATT&CK Context

• Tactic: Privilege Escalation
• Tactic: Persistence
• Tactic: Execution
• Technique: T1053.005 — T1053.005

References

• https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/
• https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04
• https://blog.talosintelligence.com/gophish-powerrat-dcrat/
• SigmaHQ Rule