SigmaHQ/rules/windows/sysmon/sysmon_susp_schtask_creation.yml

title: Scheduled Task Creation
status: experimental
description: Detects the creation of scheduled tasks in user session 
author: Florian Roth
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        Image: '*\schtasks.exe'
        CommandLine: '* /create *'
    filter:
        User: 'NT AUTHORITY\SYSTEM'
    condition: selection and not filter
fields:
    - CommandLine
    - ParentCommandLine
tags:
    - attack.execution
    - attack.persistence
    - attack.privilege_escalation
    - attack.t1053
    - attack.s0111
falsepositives:
    - Administrative activity
    - Software installation
level: low
Rule: Scheduled task creation 2017-03-13 19:45:28 +00:00			`title: Scheduled Task Creation`
			`status: experimental`
Rule: Suspicious task creation description changed 2017-03-21 09:23:53 +00:00			`description: Detects the creation of scheduled tasks in user session`
Rule: Scheduled task creation 2017-03-13 19:45:28 +00:00			`author: Florian Roth`
			`logsource:`
			`product: windows`
			`service: sysmon`
			`detection:`
			`selection:`
			`EventID: 1`
			`Image: '*\schtasks.exe'`
			`CommandLine: '* /create *'`
			`filter:`
			`User: 'NT AUTHORITY\SYSTEM'`
			`condition: selection and not filter`
Added field names to first rules 2017-09-12 21:54:04 +00:00			`fields:`
			`- CommandLine`
			`- ParentCommandLine`
ATT&CK tagging of Scheduled Task Creation 2018-07-22 12:56:47 +00:00			`tags:`
			`- attack.execution`
			`- attack.persistence`
Correct MITRE tag 2019-01-22 18:26:07 +00:00			`- attack.privilege_escalation`
ATT&CK tagging of Scheduled Task Creation 2018-07-22 12:56:47 +00:00			`- attack.t1053`
			`- attack.s0111`
Rule: Scheduled task creation 2017-03-13 19:45:28 +00:00			`falsepositives:`
			`- Administrative activity`
Rule: Suspicious task creation description changed 2017-03-21 09:23:53 +00:00			`- Software installation`
Rule: Scheduled task creation 2017-03-13 19:45:28 +00:00			`level: low`