Detectionmediumtest

Powershell Create Scheduled Task

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Tue Dec 28Updated Tue Oct 07363eccc0-279a-4ccf-a3ab-24c2e63b11fbwindows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection_cmdlet:
        ScriptBlockText|contains:
            - 'New-ScheduledTaskAction'
            - 'New-ScheduledTaskTrigger'
            - 'New-ScheduledTaskPrincipal'
            - 'New-ScheduledTaskSettingsSet'
            - 'New-ScheduledTask'
            - 'Register-ScheduledTask'
    selection_cimmethod:
        ScriptBlockText|contains|all:
            - 'Invoke-CimMethod'
            - '-ClassName'
            - 'PS_ScheduledTask'
            - '-NameSpace'
            - 'Root\Microsoft\Windows\TaskScheduler'
    filter_main_legitimate_scripts:
        ScriptBlockText|contains|all:
            - 'Microsoft.PowerShell.Core\Export-ModuleMember'
            - 'Microsoft.Management.Infrastructure.CimInstance'
            - '__cmdletization_methodParameter'
    condition: 1 of selection_* and not 1 of filter_main_*