Sigma rule: Schtasks Creation Or Modification With SYSTEM Privileges

Rule

Title

Schtasks Creation Or Modification With SYSTEM Privileges

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-07-28

Modified

2025-02-15

File

rules/windows/process_creation/proc_creation_win_schtasks_system.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

Log source

product

windows

category

process_creation

Detection

selection_root:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:
        - ' /change '
        - ' /create '
selection_run:
    CommandLine|contains: '/ru '
selection_user:
    CommandLine|contains:
        - 'NT AUT' # This covers the usual NT AUTHORITY\SYSTEM
        - ' SYSTEM ' # SYSTEM is a valid value for schtasks hence it gets it's own value with space
filter_optional_teamviewer:
    # FP from test set in SIGMA
    # Cannot use ParentImage on all OSes for 4688 events
    # ParentImage|contains|all:
    #     - '\AppData\Local\Temp\'
    #     - 'TeamViewer_.exe'
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:
        - '/TN TVInstallRestore'
        - '\TeamViewer_.exe'
filter_optional_office:
    CommandLine|contains|all:
        # https://answers.microsoft.com/en-us/msoffice/forum/all/office-15-subscription-heartbeat-task-created-on/43ab5e53-a9fb-47c6-8c14-44889974b9ff
        - 'Subscription Heartbeat'
        - '\HeartbeatConfig.xml'
        - '\Microsoft Shared\OFFICE'
filter_optional_avira:
    CommandLine|contains:
        - '/Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR '
        - ':\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe'
        - '/VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART" /RL HIGHEST'
condition: all of selection_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.execution
• attack.persistence
• attack.t1053.005

MITRE ATT&CK ids this rule names

• T1053.005

References

• https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_schtasks_system.yml