Renamed Schtasks Execution

 1title: Renamed Schtasks Execution
 2id: f91e51c9-f344-4b32-969b-0b6f6b8537d4
 3status: experimental
 4description: |
 5    Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks.
 6    One of the very common persistence techniques is schedule malicious tasks using schtasks.exe.
 7    Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.    
 8references:
 9    - https://x.com/JangPr0/status/1932034543026065833
10    - https://ss64.com/nt/schtasks.html
11author: Swachchhanda Shrawan Poudel (Nextron Systems)
12date: 2025-11-27
13tags:
14    - attack.defense-evasion
15    - attack.execution
16    - attack.persistence
17    - attack.privilege-escalation
18    - attack.t1036.003
19    - attack.t1053.005
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection_cmd_operation:
25        CommandLine|contains|windash:
26            - ' /create '
27            - ' /delete '
28            - ' /query '
29            - ' /change '
30            - ' /run '
31            - ' /end '
32    selection_cmd_flags:
33        CommandLine|contains|windash:
34            - ' /tn '
35            - ' /tr '
36            - ' /sc '
37            - ' /st '
38            - ' /ru '
39            - ' /fo '
40    selection_pe:
41        OriginalFileName: 'schtasks.exe'
42    filter_main_cmd:
43        CommandLine|contains: 'schtasks'
44    filter_main_img:
45        Image|endswith: '\schtasks.exe'
46    condition: (all of selection_cmd_* and not filter_main_cmd) or (selection_pe and not filter_main_img)
47falsepositives:
48    - Unlikely
49level: high