CmdID

CmdID / Rules / Windows

HackTool - Default PowerSploit/Empire Scheduled Task Creation

A Sigma rule for process creation on Windows, by Markus Neis, @Karneades.

high 2 ATT&CK techniques 2 programs it names

What it looks for

its detection, as SigmaHQ writes it
detection:
  selection:
    CommandLine|contains:
      - '/SC ONLOGON'
      - '/SC DAILY /ST'
      - '/SC ONIDLE'
      - '/SC HOURLY'
    CommandLine|contains|all:
      - '/Create'
      - 'powershell.exe -NonI'
      - '/TN Updater /TR'
    Image|endswith: '\schtasks.exe'
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Markus Neis, @Karneades, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

None of the everyday examples and documented commands on CmdID’s program pages trips it. To see whether a command line does, paste it into CmdID.

Programs and files it names

their pages here
schtasks.exepowershell.exe

ATT&CK

the techniques it is tagged with
T1053.005Scheduled Task/Job: Scheduled Task
T1059.001Command and Scripting Interpreter: PowerShell

Other rules for T1053.005 Scheduled Task/Job: Scheduled Task

OilRig APT Activity · Defrag Deactivation · Potential BearLPE Exploitation · ChromeLoader Malware Execution · Kapeka Backdoor Persistence Activity · Serpent Backdoor Payload Execution Via Scheduled Task · Suspicious Schtasks Execution AppData Folder · Suspicious Modification Of Scheduled Tasks · Scheduled Task Creation Via Schtasks.EXE · Scheduled Task Creation From Potential Suspicious Parent Location · Suspicious Scheduled Task Creation Involving Temp Folder · Scheduled Task Creation with Curl and PowerShell Execution Combo