Sigma rule: Suspicious Scheduled Task Creation via Masqueraded XML File

Rule

Title

Suspicious Scheduled Task Creation via Masqueraded XML File

Status

test

Level

medium

Author

Swachchhanda Shrawan Poudel, Elastic (idea)

Date

2023-04-20

Modified

2024-12-01

File

rules/windows/process_creation/proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\schtasks.exe'
    - OriginalFileName: 'schtasks.exe'
selection_cli_create:
    CommandLine|contains:
        - '/create'
        - '-create'
selection_cli_xml:
    CommandLine|contains:
        - '/xml'
        - '-xml'
filter_main_extension_xml:
    CommandLine|contains: '.xml'
filter_main_system_process:
    IntegrityLevel:
        - 'System'
        - 'S-1-16-16384'
filter_main_rundll32:
    ParentImage|endswith: '\rundll32.exe'
    ParentCommandLine|contains|all:
        - ':\WINDOWS\Installer\MSI'
        - '.tmp,zzzzInvokeManagedCustomActionOutOfProc'
filter_optional_third_party:
    ParentImage|endswith:
        # Consider removing any tools that you don't use to avoid blind spots
        - ':\ProgramData\OEM\UpgradeTool\CareCenter_*\BUnzip\Setup_msi.exe'
        - ':\Program Files\Axis Communications\AXIS Camera Station\SetupActions.exe'
        - ':\Program Files\Axis Communications\AXIS Device Manager\AdmSetupActions.exe'
        - ':\Program Files (x86)\Zemana\AntiMalware\AntiMalware.exe'
        - ':\Program Files\Dell\SupportAssist\pcdrcui.exe'
condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.execution
• attack.persistence
• attack.stealth
• attack.t1036.005
• attack.t1053.005

MITRE ATT&CK ids this rule names

• T1036.005
• T1053.005

References

• https://learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-
• https://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml