Detect Scheduled Task in Splunk
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. Attackers use schtasks.exe, the Task Scheduler GUI, .NET wrappers, WMI (via Win32_ScheduledJob or PS_ScheduledTask), or direct registry manipulation to create, modify, or delete scheduled tasks. Tasks can run under any account context including SYSTEM, enabling privilege escalation. Adversaries also create hidden tasks by deleting the Security Descriptor (SD) registry value, making tasks invisible to standard enumeration tools.
MITRE ATT&CK
- Technique
- T1053 Scheduled Task/Job
- Sub-technique
- T1053.005 Scheduled Task
- Canonical reference
- https://attack.mitre.org/techniques/T1053/005/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
(
(EventCode=1 Image="*\\schtasks.exe")
OR (EventCode=4688 NewProcessName="*\\schtasks.exe")
OR (EventCode=4698)
OR (EventCode=4702)
)
| eval CommandLine=coalesce(CommandLine, ProcessCommandLine, CommandLine)
| eval CommandLineLower=lower(CommandLine)
| eval TaskName=coalesce(TaskName, "")
| eval TaskContent=coalesce(TaskContent, "")
| eval HasCreate=if(match(CommandLineLower, "(/create|/change)"), 1, 0)
| eval RunAsSystem=if(match(CommandLineLower, "(/ru\s+(system|\"system\"|\"nt authority\\\\system\"))"), 1, 0)
| eval SuspiciousLoc=if(match(CommandLineLower, "(appdata|\\\\temp\\\\|programdata|\\\\public\\\\|%temp%|%appdata%)"), 1, 0)
| eval SuspiciousBin=if(match(CommandLineLower, "(powershell|cmd\.exe|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|msbuild|wmic|msiexec)"), 1, 0)
| eval OnLogonTrigger=if(match(CommandLineLower, "(/sc\s+(onlogon|onstartup|onstart))"), 1, 0)
| eval HighFreqTrigger=if(match(CommandLineLower, "(/sc\s+(minute|hourly))"), 1, 0)
| eval RemoteTask=if(match(CommandLineLower, "/s\s+"), 1, 0)
| eval SuspiciousParent=if(match(lower(ParentImage), "(powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|winword|excel|outlook|acrord32|msedge|chrome|firefox)"), 1, 0)
| eval IsSecurityEvent=if(EventCode=4698 OR EventCode=4702, 1, 0)
| eval SuspicionScore=HasCreate + RunAsSystem + SuspiciousLoc + SuspiciousBin + OnLogonTrigger + HighFreqTrigger + RemoteTask + SuspiciousParent + IsSecurityEvent
| where SuspicionScore > 0
| eval DetectionSource=case(
EventCode=4698, "task_created_security_log",
EventCode=4702, "task_updated_security_log",
EventCode=1, "sysmon_process_create",
EventCode=4688, "security_process_create",
true(), "unknown"
)
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
TaskName, HasCreate, RunAsSystem, SuspiciousLoc, SuspiciousBin,
OnLogonTrigger, HighFreqTrigger, RemoteTask, SuspiciousParent,
SuspicionScore, DetectionSource, EventCode
| sort - SuspicionScore, - _timeDetects malicious scheduled task creation and modification by combining Sysmon Event ID 1 (Process Create), Security Event ID 4688 (Process Create with command line auditing), Security Event ID 4698 (Scheduled Task Created), and Security Event ID 4702 (Scheduled Task Updated). Evaluates command-line arguments for suspicious patterns including SYSTEM execution, suspicious binary locations, logon/startup triggers, high-frequency intervals, remote task creation, and suspicious parent processes. A composite suspicion score enables analyst prioritization.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Software installers and patch management tools (SCCM, Intune, PDQ Deploy) that create scheduled tasks as part of software deployment workflows
- Legitimate IT automation and monitoring agents (SolarWinds, Nagios, Datadog, Ansible) that create or modify scheduled tasks for health checks and data collection
- Antivirus and endpoint security products creating scheduled tasks for definition updates, scans, and health monitoring
- Developer and DevOps toolchains (CI/CD agents, build servers) that schedule recurring jobs via schtasks
- System administrators manually creating maintenance tasks from elevated shells during change windows
Other platforms for T1053.005
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Persistence Scheduled Task Running as SYSTEM
Expected signal: Sysmon Event ID 1: Process Create with Image=schtasks.exe, CommandLine containing '/create', '/tn WindowsSystemCheck', '/ru SYSTEM', '/sc onstart'. Security Event ID 4688 (if command line auditing enabled). Security Event ID 4698 (Scheduled Task Created) in Security log with task XML showing SYSTEM principal. Registry key created under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\ (ONSTART trigger).
- Test 2Scheduled Task with PowerShell Download Cradle Action
Expected signal: Sysmon Event ID 1: schtasks.exe with full command line including the PowerShell cradle. Security Event ID 4698 with task XML showing PowerShell action with hidden window and download cradle. Task XML file written to C:\Windows\System32\Tasks\MicrosoftEdgeUpdateCheck. Registry entries created under TaskCache\Logon\.
- Test 3Scheduled Task Created via PowerShell (Invoke-CimMethod)
Expected signal: Sysmon Event ID 1: powershell.exe process with command line containing Register-ScheduledTask. Security Event ID 4698: Scheduled Task Created (WmiTaskTest). Sysmon Event ID 13: Registry value written to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\ by powershell.exe (not svchost.exe). Task XML file written to C:\Windows\System32\Tasks\WmiTaskTest.
- Test 4Hidden Scheduled Task via SD Registry Value Deletion
Expected signal: Sysmon Event ID 1: schtasks.exe creating the task. Sysmon Event ID 14 (Registry Key/Value Deleted): TargetObject = HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HiddenPersistTask\SD, Image = reg.exe. Security Event ID 4698: task created. After SD deletion, task is absent from schtasks /query but still active in TaskCache.
- Test 5Remote Scheduled Task Creation for Lateral Movement
Expected signal: Sysmon Event ID 1: schtasks.exe with CommandLine containing '/s 127.0.0.1', '/ru SYSTEM', '/create'. Security Event ID 4698: Scheduled Task Created on target (local) system. Network connection attempt to localhost Task Scheduler RPC interface (port 135/dynamic RPC). Security Event ID 4648 (Logon with explicit credentials) if alternate credentials used.
References (11)
- https://attack.mitre.org/techniques/T1053/005/
- https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
- https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events
- https://technet.microsoft.com/library/dd315590.aspx
- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
- https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain
- https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page
- https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen
Unlock Pro Content
Get the full detection package for T1053.005 including response playbook, investigation guide, and atomic red team tests.