Sigma rule: Suspicious Scheduled Task Creation

Rule

Title

Suspicious Scheduled Task Creation

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-12-05

Modified

2022-12-07

File

rules/windows/builtin/security/win_security_susp_scheduled_task_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

Log source

product

windows

service

security

definition

The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.

Detection

selection_eid:
    EventID: 4698
selection_paths:
    TaskContent|contains:
        - '\AppData\Local\Temp\'
        - '\AppData\Roaming\'
        - '\Users\Public\'
        - '\WINDOWS\Temp\'
        - 'C:\Temp\'
        - '\Desktop\'
        - '\Downloads\'
        - '\Temporary Internet'
        - 'C:\ProgramData\'
        - 'C:\Perflogs\'
selection_commands:
    TaskContent|contains:
        - 'regsvr32'
        - 'rundll32'
        - 'cmd.exe</Command>'
        - 'cmd</Command>'
        - '<Arguments>/c '
        - '<Arguments>/k '
        - '<Arguments>/r '
        - 'powershell'
        - 'pwsh'
        - 'mshta'
        - 'wscript'
        - 'cscript'
        - 'certutil'
        - 'bitsadmin'
        - 'bash.exe'
        - 'bash '
        - 'scrcons'
        - 'wmic '
        - 'wmic.exe'
        - 'forfiles'
        - 'scriptrunner'
        - 'hh.exe'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.privilege-escalation
• attack.persistence
• attack.t1053.005

MITRE ATT&CK ids this rule names

• T1053.005

References

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_susp_scheduled_task_creation.yml