Detection of Scheduled Task Manipulation via Command Shells

This detection focuses on identifying suspicious manipulation of Windows Scheduled Tasks, a common technique used by threat actors to maintain persistence, escalate privileges, or execute malicious code. Adversaries often invoke 'schtasks.exe' via command-line interpreters such as 'cmd.exe', 'wscript.exe', or 'cscript.exe' to automate the execution of secondary payloads. By filtering out tasks initiated from trusted system directories like 'C:\Windows\System32' and 'C:\Program Files', as well as those initiated by service accounts, this analytic isolates anomalous activity that deviates from standard administrative workflows. This behavior is associated with numerous malware families and living-off-the-land techniques documented in security research, including Qakbot and various ransomware variants. Defenders should prioritize investigating task modifications that originate from user-context command shells, as these are strong indicators of potential system compromise and unauthorized code execution.

Attack Chain

1. An adversary gains initial access to a Windows endpoint.
2. The attacker drops a malicious binary or script into a non-standard directory (e.g., %TEMP% or %APPDATA%).
3. The attacker opens a command shell (e.g., cmd.exe) or executes a script (wscript.exe).
4. The adversary runs 'schtasks.exe' to create a new task or modify an existing one.
5. The 'schtasks.exe' process is spawned as a child process of the initial command shell.
6. The new scheduled task is configured to execute the dropped malicious file at a specific interval or trigger.
7. The scheduled task executes, achieving persistence and potential privilege escalation.

Impact

Successful abuse of scheduled tasks allows attackers to maintain long-term access to compromised systems even after a reboot. This technique has been observed in various large-scale campaigns, enabling attackers to deploy ransomware, exfiltrate sensitive data, or install secondary backdoors, leading to full domain compromise and significant operational disruption within targeted sectors.

Recommendation

• Deploy the Sigma rule below to detect abnormal invocation of 'schtasks.exe'.
• Enable Sysmon Event ID 1 (Process Creation) across all Windows endpoints to capture full command-line arguments, including parent process information.
• Integrate process-level telemetry into your SIEM and map events to the Endpoint data model to ensure visibility into parent-child process relationships.
• Establish a baseline of legitimate scheduled task management in your environment to identify and tune out authorized administrative activity.