Suspicious Schtasks Schedule Types

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects the creation or modification of scheduled tasks using `schtasks.exe` with suspicious schedule types such as 'ONLOGON', 'ONSTART', 'ONCE', or 'ONIDLE'. This rule specifically filters out common legitimate system accounts like 'NT AUTHORITY\SYSTEM' and 'SYSTEM' and the 'HIGHEST' privilege setting to reduce false positives.