Sigma rule: Renamed Schtasks Execution

Rule

Title

Renamed Schtasks Execution

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-11-27

Modified

2026-10-02

File

rules/windows/process_creation/proc_creation_win_renamed_schtasks_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks.
One of the very common persistence techniques is schedule malicious tasks using schtasks.exe.
Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.

Log source

product

windows

category

process_creation

Detection

selection_cmd_operation:
    CommandLine|contains|windash:
        - ' /create '
        - ' /delete '
        - ' /query '
        - ' /change '
        - ' /run '
        - ' /end '
selection_cmd_flags:
    CommandLine|contains|windash:
        - ' /tn '
        - ' /tr '
        - ' /sc '
        - ' /st '
        - ' /ru '
        - ' /fo '
selection_pe:
    OriginalFileName: 'schtasks.exe'
filter_main_cmd:
    CommandLine|contains: 'schtasks'
filter_main_img:
    Image|endswith: '\schtasks.exe'
filter_optional_cmd_openfiles:
    CommandLine|contains|all:
        - 'openfiles'
        - ' /query '
        - ' /fo'
condition: (all of selection_cmd_* and not filter_main_cmd and not filter_optional_cmd_openfiles) or (selection_pe and not filter_main_img)

False positives (as the rule lists them)

• Unlikely

Tags

• attack.execution
• attack.persistence
• attack.privilege-escalation
• attack.stealth
• attack.t1036.003
• attack.t1053.005

MITRE ATT&CK ids this rule names

• T1036.003
• T1053.005

References

• https://x.com/JangPr0/status/1932034543026065833
• https://ss64.com/nt/schtasks.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_renamed_schtasks_execution.yml