title: Suspicious Add Scheduled Command Pattern
id: f2c64357-b1d2-41b7-849f-34d2682c0fad
description: Detects suspicious scheduled task creations with commands that are uncommon
status: experimental
references:
   - https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/
tags:
   - attack.execution
   - attack.t1053.005 
author: Florian Roth
date: 2022/02/23
logsource:
   product: windows
   category: process_creation
detection:
   selection_schtasks:
      Image|endswith: 'schtasks.exe'
      CommandLine|contains: '/Create '
   selection_rare:
      CommandLine|contains:
         - '/sc minute '
         - '/ru system '
   selection_pattern:
      CommandLine|contains:
         - 'cmd.exe /c '
         - 'cmd /c'
         - ' -w hidden '
         - ' bypass '
         - ' IEX'
         - ' -enc '
         - ' -decode '
         - '.DownloadString'
         - '.DownloadFile'
         - 'FromBase64String'
   selection_anomaly:
      - CommandLine|contains|all:
         - '/xml C:\Users\'
         - '\AppData\Local\'
      - CommandLine|contains|all:
         - 'wscript.exe'
         - '\AppData\'
   condition: selection_schtasks and ( selection_rare and selection_pattern or selection_anomaly )
falsepositives:
   - Software installers that run from temporary folders and also install scheduled tasks
level: high
