mcpField
D
detecting-malicious-scheduled-tasks-with-sysmon

detecting-malicious-scheduled-tasks-with-sysmon

github.com/mukul975Security35.2k42 installsUpdated 8w ago
Repository

About detecting-malicious-scheduled-tasks-with-sysmon

A detection skill for SOC analysts investigating suspicious Windows scheduled tasks with Sysmon and Windows event data. It describes event correlation and hunts for encoded commands, suspicious execution paths, and remote task creation.

Key features

  1. 01Configure task-related Sysmon events
  2. 02Detect suspicious schtasks.exe arguments
  3. 03Correlate task registration and process events
  4. 04Hunt encoded commands and public paths
  5. 05Alert on remote task creation

Use cases

  1. 01Investigating scheduled-task persistence
  2. 02Detecting encoded task payloads
  3. 03Finding tasks launched from public directories
  4. 04Hunting remote task creation

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill detecting-malicious-scheduled-tasks-with-sysmon

After installing, type/detecting-malicious-scheduled-tasks-with-sysmonin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Detecting Malicious Scheduled Tasks with Sysmon

Overview

Adversaries abuse Windows Task Scheduler (schtasks.exe, at.exe) for persistence (T1053.005) and lateral movement. Sysmon Event ID 1 captures schtasks.exe process creation with full command-line arguments, while Event ID 11 captures task XML files written to C:\Windows\System32\Tasks. Windows Security Event 4698 logs task registration details. This skill covers building detection rules that correlate these events to identify malicious scheduled tasks created from suspicious paths, with encoded payloads, or targeting remote systems.

When to Use

  • When investigating security incidents that require detecting malicious scheduled tasks with sysmon
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Sysmon installed with a detection-focused configuration (e.g., SwiftOnSecurity or Olaf Hartong)
  • Windows Event Log forwarding to SIEM (Splunk, Elastic, or Sentinel)
  • PowerShell ScriptBlock Logging enabled (Event 4104)

Steps

  1. Configure Sysmon to log Event IDs 1, 11, 12, 13 with task-related filters
  2. Build detection rules for schtasks.exe /create with suspicious arguments
  3. Correlate Event 4698 (task registered) with Sysmon Event 1 (process create)
  4. Hunt for tasks executing from public directories or with encoded commands
  5. Alert on remote task creation (schtasks /s) for lateral movement detection

Expected Output

[CRITICAL] Suspicious Scheduled Task Detected
  Task: \Microsoft\Windows\UpdateCheck
  Command: powershell.exe -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGU...
  Created By: DOMAIN\compromised_user
  Parent Process: cmd.exe (PID 4532)
  Source: \\192.168.1.50 (remote creation)
  MITRE: T1053.005 - Scheduled Task/Job

Comments

Markdown supported