Detectionmediumtest

Suspicious Scheduled Task Creation via Masqueraded XML File

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan Poudel, Elastic SecurityCreated Thu Apr 20Updated Sun Dec 01dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0cwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\schtasks.exe'
        - OriginalFileName: 'schtasks.exe'
    selection_cli_create:
        CommandLine|contains:
            - '/create'
            - '-create'
    selection_cli_xml:
        CommandLine|contains:
            - '/xml'
            - '-xml'
    filter_main_extension_xml:
        CommandLine|contains: '.xml'
    filter_main_system_process:
        IntegrityLevel:
            - 'System'
            - 'S-1-16-16384'
    filter_main_rundll32:
        ParentImage|endswith: '\rundll32.exe'
        ParentCommandLine|contains|all:
            - ':\WINDOWS\Installer\MSI'
            - '.tmp,zzzzInvokeManagedCustomActionOutOfProc'
    filter_optional_third_party:
        ParentImage|endswith:
            # Consider removing any tools that you don't use to avoid blind spots
            - ':\ProgramData\OEM\UpgradeTool\CareCenter_*\BUnzip\Setup_msi.exe'
            - ':\Program Files\Axis Communications\AXIS Camera Station\SetupActions.exe'
            - ':\Program Files\Axis Communications\AXIS Device Manager\AdmSetupActions.exe'
            - ':\Program Files (x86)\Zemana\AntiMalware\AntiMalware.exe'
            - ':\Program Files\Dell\SupportAssist\pcdrcui.exe'
    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*