title: Suspicius Schtasks From Env Var Folder
id: 81325ce1-be01-4250-944f-b4789644556f
description: Detects Schtask creations that point to a folder references in environment variables or often used by malware
status: experimental
references:
    - https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/
    - https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04
tags:
    - attack.execution
    - attack.t1053.005 
author: Florian Roth
date: 2022/02/21
modified: 2022/03/11
logsource:
    product: windows
    category: process_creation
detection:
    selection1_create:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: ' /create '
    selection1_all_folders:
        CommandLine|contains:
            - '%AppData%'
            - '\AppData\Local\'
            - '\AppData\Roaming\'
            - '%Public%'
            - '\Users\Public'
            - 'C:\Windows\Temp'
            - 'C:\Perflogs'
    selection2_parent:
        ParentCommandLine|endswith: '\svchost.exe -k netsvcs -p -s Schedule'
    selection2_some_folders:
        CommandLine|contains:
            - '%Public%'
            - '\Users\Public'
            - 'C:\Windows\Temp'
            - 'C:\Perflogs'
    filter_mixed:
        - CommandLine|contains: 'update_task.xml'
        - ParentCommandLine|contains: 'unattended.ini'
    condition: ( all of selection1* or all of selection2* ) and not 1 of filter*
falsepositives:
    - Benign scheduled tasks creations or executions that happen often during software installations
    - Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders
level: high
