Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1053.005

Scheduled Task

ExecutionPersistencePrivilege Escalation 94 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
sigma HackTool - Defendnot Default Scheduled Task Activity experimental 2026-10-18
splunk Scheduled Task Deleted Or Created via CMD production 2026-10-09
splunk Possible Lateral Movement PowerShell Spawn production 2026-10-09
splunk Svchost LOLBAS Execution Process Spawn production 2026-10-09
splunk Windows Scheduled Task Service Spawned Shell production 2026-10-09
elastic Unusual Scheduled Task Update production 2026-10-06
elastic Scheduled Task Execution at Scale via GPO production 2026-10-06
elastic Persistence via a Windows Installer production 2026-10-05
splunk Windows PowerShell ScheduleTask production 2026-10-02
splunk Schtasks scheduling job on remote system production 2026-10-02
sigma Renamed Schtasks Execution experimental 2026-10-02
splunk Scheduled Task Initiation on Remote Endpoint production 2026-10-02
splunk Windows Scheduled Task with Suspicious Name production 2026-09-22
splunk Windows Scheduled Task with Suspicious Command production 2026-09-22
elastic Temporarily Scheduled Task Creation production 2026-09-21
elastic Suspicious Image Load (taskschd.dll) from MS Office production 2026-09-18
elastic Suspicious ScreenConnect Client Child Process production 2026-09-18
elastic Potential PowerShell HackTool Script by Function Names production 2026-09-18
elastic Outbound Scheduled Task Activity via PowerShell production 2026-09-18
elastic Local Scheduled Task Creation production 2026-09-18
elastic Scheduled Task Created by a Windows Script production 2026-09-18
elastic UAC Bypass via DiskCleanup Scheduled Task Hijack production 2026-09-18
elastic Creation or Modification of a new GPO Scheduled Task or Service production 2026-09-18
elastic Persistence via TelemetryController Scheduled Task Hijack production 2026-09-18
elastic Remote Scheduled Task Creation via RPC production 2026-09-18
elastic Suspicious Execution via Scheduled Task production 2026-09-18
elastic Remote Scheduled Task Creation production 2026-09-18
elastic Persistence via Scheduled Job Creation production 2026-09-18
splunk Windows Error Report Created in ReportQueue Manually production 2026-08-18
splunk Short Lived Scheduled Task production 2026-07-07
splunk Windows Compatibility Telemetry Suspicious Child Process production 2026-05-13
splunk WinEvent Scheduled Task Created to Spawn Shell production 2026-05-13
splunk Windows Schtasks Create Run As System production 2026-05-13
splunk Windows Scheduled Task with Highest Privileges production 2026-05-13
splunk Windows Scheduled Task Created Via XML production 2026-05-13
splunk Windows Scheduled Task Created in a Group Policy Object production 2026-05-13
splunk Windows Registry Delete Task SD production 2026-05-13
splunk Windows Enable Win32 ScheduledJob via Registry production 2026-05-13
splunk Randomly Generated Scheduled Task Name experimental 2026-05-13
splunk Schtasks used for forcing a reboot production 2026-05-13
splunk Suspicious Scheduled Task from Public Directory production 2026-05-13
splunk Windows Compatibility Telemetry Tampering Through Registry production 2026-05-13
splunk WinEvent Windows Task Scheduler Event Action Started production 2026-05-13
splunk WinEvent Scheduled Task Created Within Public Path production 2026-05-13
sigma Scheduled TaskCache Change by Uncommon Program test 2025-10-22
sigma Scheduled Task Creation Via Schtasks.EXE test 2025-10-22
sigma Turla Group Commands May 2020 test 2025-10-19
sigma Powershell Create Scheduled Task test 2025-10-07
sigma Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE test 2025-10-07
sigma Potential SSH Tunnel Persistence Install Using A Scheduled Task experimental 2025-07-14
sigma Schtasks Creation Or Modification With SYSTEM Privileges test 2025-02-15
sigma Scheduled Task Creation with Curl and PowerShell Execution Combo experimental 2025-02-05
sigma Scheduled Task Creation Masquerading as System Processes experimental 2025-02-05
sigma Suspicious Scheduled Task Creation via Masqueraded XML File test 2024-12-01
sigma Persistence and Execution at Scale via GPO Scheduled Task test 2024-09-04
sigma Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location test 2024-09-02
sigma Kapeka Backdoor Persistence Activity test 2024-07-03
sigma Kapeka Backdoor Scheduled Task Creation test 2024-07-03
sigma Scheduled Task Creation From Potential Suspicious Parent Location test 2024-05-13
sigma Suspicious Command Patterns In Scheduled Task Creation test 2024-03-19
sigma Diamond Sleet APT Scheduled Task Creation test 2023-10-24
sigma Scheduled Task Created - Registry test 2023-09-27
sigma Scheduled Task Created - FileCreation test 2023-09-27
sigma Potential Registry Persistence Attempt Via Windows Telemetry test 2023-08-17
sigma Scheduled Task Executing Payload from Registry test 2023-07-18
sigma Potential ACTINIUM Persistence Activity test 2023-03-18
sigma Important Scheduled Task Deleted/Disabled test 2023-03-13
sigma OilRig APT Schedule Task Persistence - System test 2023-03-08
sigma OilRig APT Schedule Task Persistence - Security test 2023-03-08
sigma OilRig APT Registry Persistence test 2023-03-08
sigma OilRig APT Activity test 2023-03-08
sigma HackTool - Default PowerSploit/Empire Scheduled Task Creation test 2023-03-03
sigma Potential Persistence Via Microsoft Compatibility Appraiser test 2023-02-10
sigma Scheduled Task Executed Uncommon LOLBIN test 2023-02-07
sigma Scheduled Task Executed From A Suspicious Location test 2023-02-07
sigma Scheduled Task Executing Encoded Payload from Registry test 2023-02-04
sigma Uncommon One Time Only Scheduled Task At 00:00 test 2023-02-03
sigma Potential Persistence Via Powershell Search Order Hijacking - Task test 2023-02-03
sigma Potential BearLPE Exploitation test 2023-01-26
sigma Scheduled Task Deletion test 2023-01-20
sigma Suspicious Scheduled Task Creation test 2022-12-07
sigma Suspicious Scheduled Task Update test 2022-12-05
sigma Operation Wocao Activity - Security test 2022-11-27
sigma Schtasks From Suspicious Folders test 2022-11-18
sigma Suspicious Modification Of Scheduled Tasks test 2022-11-18
sigma Suspicious Scheduled Task Name As GUID test 2022-10-31
sigma Suspicious Scheduled Task Creation Involving Temp Folder test 2022-10-09
sigma Defrag Deactivation test 2022-10-09
sigma Operation Wocao Activity test 2022-10-09
sigma Suspicious Schtasks Schedule Types test 2022-09-09
sigma Suspicious Schtasks Schedule Type With High Privileges test 2022-08-31
sigma Suspicious Schtasks Execution AppData Folder test 2022-07-28
sigma Serpent Backdoor Payload Execution Via Scheduled Task test 2022-03-21
sigma ChromeLoader Malware Execution test 2022-01-10