Scheduled tasks that run a command
A scheduled task starts a program at a set time, at startup or at logon, under any account its creator names. In the recordings an attacker created three tasks with schtasks.exe: two start PowerShell daily or at logon, one of them as SYSTEM, and the third was created on another machine under a Microsoft folder name. Microsoft Office on the clean Windows 10 client also creates, deletes and changes its own tasks with schtasks.exe. Find the three tasks the attacker created.
Hint 1
With /Create, the /TR switch gives the command the task will run. Office creates its tasks from an XML file with /XML instead.
Hint 2
schtasks.exe accepts its switches in any letter case, and Sigma's contains is case-insensitive.
The rule runs in this browser; it is saved here so you can come back to it.
Events
2,442 events. Search filters the table; it does not affect the result.