Renamed Schtasks Execution

calendar Oct 2, 2026 · attack.execution attack.persistence attack.privilege-escalation attack.stealth attack.t1036.003 attack.t1053.005  ·
Share on: linkedin copy

Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks. One of the very common persistence techniques is schedule malicious tasks using schtasks.exe. Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.

Sigma rule (View on GitHub)

 1title: Renamed Schtasks Execution
 2id: f91e51c9-f344-4b32-969b-0b6f6b8537d4
 3status: experimental
 4description: |
 5    Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks.
 6    One of the very common persistence techniques is schedule malicious tasks using schtasks.exe.
 7    Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.    
 8references:
 9    - https://x.com/JangPr0/status/1932034543026065833
10    - https://ss64.com/nt/schtasks.html
11author: Swachchhanda Shrawan Poudel (Nextron Systems)
12date: 2025-11-27
13modified: 2026-10-02
14tags:
15    - attack.execution
16    - attack.persistence
17    - attack.privilege-escalation
18    - attack.stealth
19    - attack.t1036.003
20    - attack.t1053.005
21logsource:
22    category: process_creation
23    product: windows
24detection:
25    selection_cmd_operation:
26        CommandLine|contains|windash:
27            - ' /create '
28            - ' /delete '
29            - ' /query '
30            - ' /change '
31            - ' /run '
32            - ' /end '
33    selection_cmd_flags:
34        CommandLine|contains|windash:
35            - ' /tn '
36            - ' /tr '
37            - ' /sc '
38            - ' /st '
39            - ' /ru '
40            - ' /fo '
41    selection_pe:
42        OriginalFileName: 'schtasks.exe'
43    filter_main_cmd:
44        CommandLine|contains: 'schtasks'
45    filter_main_img:
46        Image|endswith: '\schtasks.exe'
47    filter_optional_cmd_openfiles:
48        CommandLine|contains|all:
49            - 'openfiles'
50            - ' /query '
51            - ' /fo'
52    condition: (all of selection_cmd_* and not filter_main_cmd and not filter_optional_cmd_openfiles) or (selection_pe and not filter_main_img)
53falsepositives:
54    - Unlikely
55level: high
56regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_schtasks_execution/info.yml

References

Related rules

to-top