Suspicious Execution via Scheduled Task

  1[metadata]
  2creation_date = "2020/11/19"
  3integration = ["endpoint", "windows"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = "Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage."
 10false_positives = ["Legitimate scheduled tasks running third party software."]
 11from = "now-9m"
 12index = ["logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*"]
 13language = "eql"
 14license = "Elastic License v2"
 15name = "Suspicious Execution via Scheduled Task"
 16note = """## Triage and analysis
 17
 18> **Disclaimer**:
 19> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 20
 21### Investigating Suspicious Execution via Scheduled Task
 22
 23Scheduled tasks in Windows automate routine tasks, but adversaries exploit them for persistence and execution of malicious programs. By examining process lineage and command line usage, the detection rule identifies suspicious executions initiated by scheduled tasks. It flags known malicious executables and unusual file paths, while excluding benign processes, to pinpoint potential threats effectively.
 24
 25### Possible investigation steps
 26
 27- Review the process lineage to confirm the parent process is "svchost.exe" with arguments containing "Schedule" to verify the execution was initiated by a scheduled task.
 28- Examine the command line arguments and file paths of the suspicious process to identify any unusual or unauthorized file locations, such as those listed in the query (e.g., "C:\\Users\\*", "C:\\ProgramData\\*").
 29- Check the original file name of the process against the list of known suspicious executables (e.g., "PowerShell.EXE", "Cmd.Exe") to determine if it matches any commonly abused binaries.
 30- Investigate the user context under which the process was executed, especially if it deviates from expected system accounts or known service accounts.
 31- Correlate the event with other security logs or alerts to identify any related suspicious activities or patterns that might indicate a broader attack campaign.
 32- Assess the risk and impact of the detected activity by considering the severity and risk score provided, and determine if immediate containment or remediation actions are necessary.
 33
 34### False positive analysis
 35
 36- Scheduled tasks running legitimate scripts or executables like cmd.exe or cscript.exe in system directories may trigger false positives. To manage this, create exceptions for these processes when they are executed from known safe directories such as C:\\Windows\\System32.
 37- PowerShell scripts executed by the system account (S-1-5-18) for administrative tasks can be mistakenly flagged. Exclude these by specifying exceptions for PowerShell executions with arguments like -File or -PSConsoleFile when run by the system account.
 38- Legitimate software installations or updates using msiexec.exe by the system account may be incorrectly identified as threats. Mitigate this by excluding msiexec.exe processes initiated by the system account.
 39- Regular maintenance tasks or scripts stored in common directories like C:\\ProgramData or C:\\Windows\\Temp might be flagged. Review these tasks and exclude known benign scripts or executables from these paths.
 40- Custom scripts or administrative tools that mimic suspicious executables (e.g., PowerShell.EXE, RUNDLL32.EXE) but are part of routine operations should be reviewed and excluded if verified as safe.
 41
 42### Response and remediation
 43
 44- Immediately isolate the affected system from the network to prevent further spread of any potential malicious activity.
 45- Terminate any suspicious processes identified by the detection rule, especially those matching the flagged executables and paths.
 46- Conduct a thorough review of scheduled tasks on the affected system to identify and disable any unauthorized or suspicious tasks.
 47- Remove any malicious files or executables found in the suspicious paths listed in the detection rule.
 48- Restore the system from a known good backup if malicious activity is confirmed and system integrity is compromised.
 49- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected.
 50- Implement enhanced monitoring and logging for scheduled tasks and the flagged executables to detect similar threats in the future."""
 51references = [
 52    "https://www.elastic.co/security-labs/elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper",
 53]
 54risk_score = 47
 55rule_id = "5d1d6907-0747-4d5d-9b24-e4a18853dc0a"
 56severity = "medium"
 57tags = [
 58    "Domain: Endpoint",
 59    "OS: Windows",
 60    "Use Case: Threat Detection",
 61    "Tactic: Persistence",
 62    "Tactic: Execution",
 63    "Data Source: Elastic Defend",
 64    "Resources: Investigation Guide",
 65    "Data Source: Sysmon",
 66    "Noise: High",
 67    "Performance: Normal",
 68    "Profile: Aggressive",
 69    "Rule Type: Event Correlation (EQL)",
 70    "Platform: Windows",
 71]
 72timestamp_override = "event.ingested"
 73type = "eql"
 74
 75query = '''
 76process where host.os.type == "windows" and event.type == "start" and
 77    /* Schedule service cmdline on Win10+ */
 78    process.parent.name : "svchost.exe" and process.parent.args : "Schedule" and
 79    /* add suspicious programs here */
 80    process.pe.original_file_name in
 81                                (
 82                                  "cscript.exe",
 83                                  "wscript.exe",
 84                                  "PowerShell.EXE",
 85                                  "Cmd.Exe",
 86                                  "MSHTA.EXE",
 87                                  "RUNDLL32.EXE",
 88                                  "REGSVR32.EXE",
 89                                  "MSBuild.exe",
 90                                  "InstallUtil.exe",
 91                                  "RegAsm.exe",
 92                                  "RegSvcs.exe",
 93                                  "msxsl.exe",
 94                                  "CONTROL.EXE",
 95                                  "EXPLORER.EXE",
 96                                  "Microsoft.Workflow.Compiler.exe",
 97                                  "msiexec.exe"
 98                                  ) and
 99    /* add suspicious paths here */
100    process.args : (
101       "C:\\Users\\*",
102       "C:\\ProgramData\\*",
103       "C:\\Windows\\Temp\\*",
104       "C:\\Windows\\Tasks\\*",
105       "C:\\PerfLogs\\*",
106       "C:\\Intel\\*",
107       "C:\\Windows\\Debug\\*",
108       "C:\\HP\\*") and
109
110    not (process.name : "cmd.exe" and process.args : ("*.bat", "*.cmd")) and
111    not (process.name : "cscript.exe" and process.args : "?:\\Windows\\system32\\calluxxprovider.vbs") and
112    not (
113       process.name : "powershell.exe" and
114       process.args : (
115           "-File", "-PSConsoleFile",
116           "C:\\ProgramData\\Microsoft\\AutopatchSetupScheduled\\SetupAutopatchClientV2Package.ps1",
117           "C:\\ProgramData\\Microsoft\\AutopatchSetupScheduled\\SetupAutopatchClientPackage.ps1",
118           "C:\\Windows\\Temp\\MSS\\MDESetup\\Invoke-MDESetup.ps1"
119       ) and user.id : "S-1-5-18"
120    ) and
121    not (process.name : "msiexec.exe" and user.id : "S-1-5-18") and
122    not (process.name : "powershell.exe" and
123         process.command_line : ("C:\\ProgramData\\ElasticAgent-HealthCheck.ps1",
124                                 "C:\\ProgramData\\ssh\\puttysetup.ps1"))
125'''
126
127setup = """## Setup
128
129This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
130
131Setup instructions: https://ela.st/install-elastic-defend
132
133### Additional data sources
134
135This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
136
137- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
138"""
139
140
141[[rule.threat]]
142framework = "MITRE ATT&CK"
143[[rule.threat.technique]]
144id = "T1053"
145name = "Scheduled Task/Job"
146reference = "https://attack.mitre.org/techniques/T1053/"
147[[rule.threat.technique.subtechnique]]
148id = "T1053.005"
149name = "Scheduled Task"
150reference = "https://attack.mitre.org/techniques/T1053/005/"
151
152
153
154[rule.threat.tactic]
155id = "TA0003"
156name = "Persistence"
157reference = "https://attack.mitre.org/tactics/TA0003/"
158[[rule.threat]]
159framework = "MITRE ATT&CK"
160[[rule.threat.technique]]
161id = "T1053"
162name = "Scheduled Task/Job"
163reference = "https://attack.mitre.org/techniques/T1053/"
164[[rule.threat.technique.subtechnique]]
165id = "T1053.005"
166name = "Scheduled Task"
167reference = "https://attack.mitre.org/techniques/T1053/005/"
168
169
170
171[rule.threat.tactic]
172id = "TA0002"
173name = "Execution"
174reference = "https://attack.mitre.org/tactics/TA0002/"