Query: detection rule: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware
Matching passage: Sigma rule: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware. Logsource: windows / process_creation. Rule: title: Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE id: 81325ce1-be01-4250-944f-b4789644556f related: - id: 43f487f0-755f-4c2a-bce7-d6d2eec2fcf8 type: derived status: test description: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware references: - https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/ - https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04 - https://blog.talosintelligence.com/gophish-powerrat-dcrat/ author: Florian Roth (Nextron Systems) date: 2022-02-21 modified: 2025-10-07 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_1_create: Image|endswith: \schtasks.exe CommandLine|contains|windash: ' /create ' selection_1_all_folders: CommandLine|contains: - :\Perflogs - :\Users\All Users\ - :\Users\Default\ - :\Users\Public - :\Windows\Temp - \AppData\Local\ - \AppData\Roaming\ - '%AppData%' - '%Public%' selection_2_parent: ParentCommandLine|endswith: \svchost.exe -k netsvcs -p -s Schedule selection_2_some_folders: CommandLine|contains: - :\Perflogs - :\Windows\Temp - \Users\Public - '%Public%' filter_optional_other: - ParentCommandLine|contains: unattended.ini - CommandLine|contains: update_task.xml filter_optional_team_viewer: CommandLine|contains: /Create /TN TVInstallRestore /TR filter_optional_avira_install: CommandLine|contains|all: - '/Create /Xml ' - \Temp\.CR. - \Avira_Security_Installation.xml filter_optional_avira_other: CommandLine|contains|all: - /Create /F /TN - '/Xml ' - \Temp\ - Avira_ CommandLine|contains: - .tmp\UpdateFallbackTask.xml - .tmp\WatchdogServiceControlManagerTimeout.xml - .tmp\SystrayAutostart.xml - .tmp\MaintenanceTask.xml filter_optional_klite_codec: CommandLine|contains|all: - \Temp\ - '/Create /TN "klcp_update" /XML ' - \klcp_update_task.xml condition: ( all of selection_1_* or all of selection_2_* ) and not 1 of filter_optional_* falsepositives: - Benign scheduled tasks creations or executions that happen often during software installations - Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders level: medium
Near-miss passage: Sigma rule: Detects ScreenConnect program starts that establish a remote access to a system.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - ScreenConnect Installation Execution id: 75bfe6e6-cd8e-429e-91d3-03921e1d7962 status: test description: Detects ScreenConnect program starts that establish a remote access to a system. references: - https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies author: Florian Roth (Nextron Systems) date: 2021-02-11 modified: 2024-02-26 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - e=Access& - y=Guest& - '&p=' - '&c=' - '&k=' condition: selection falsepositives: - Legitimate use by administrative staff level: medium