Scheduled task registered to run a recurring file transfer

Siemphony@siemphonymediumT1029unverified

Catches the registration of a Windows scheduled task whose action is a file transfer utility and whose trigger repeats — minute, hourly, daily or an explicit repetition interval. AN1118 is about time-based regularity, and Sigma has no time-window or aggregation operator, so recurrence cannot be measured across events; what this rule can see is the moment the recurrence is *declared* on the command line, which is the only point in the chain where a single event carries both the schedule and the transfer. Coverage is therefore genuinely partial: a task created through the COM Task Scheduler API, an XML import, or an existing task repurposed to exfiltrate produces no schtasks command line and this rule stays silent. MITRE's TimeWindow, DestIPAllowlist and ParentProcessBaseline knobs all describe cross-event correlation and none of them can be expressed here. Requires process-creation telemetry with arguments — Sysmon EventID 1, or Security 4688 with both *Audit Process Creation* and the separate *Include command line in process creation events* policy, neither of which is on by default. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0399, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\schtasks.exe" and (ProcessCommandLine contains "-create" or ProcessCommandLine contains "/create" or ProcessCommandLine contains "–create" or ProcessCommandLine contains "—create" or ProcessCommandLine contains "―create") and (ProcessCommandLine contains "-sc minute" or ProcessCommandLine contains "/sc minute" or ProcessCommandLine contains "–sc minute" or ProcessCommandLine contains "—sc minute" or ProcessCommandLine contains "―sc minute" or ProcessCommandLine contains "-sc hourly" or ProcessCommandLine contains "/sc hourly" or ProcessCommandLine contains "–sc hourly" or ProcessCommandLine contains "—sc hourly" or ProcessCommandLine contains "―sc hourly" or ProcessCommandLine contains "-sc daily" or ProcessCommandLine contains "/sc daily" or ProcessCommandLine contains "–sc daily" or ProcessCommandLine contains "—sc daily" or ProcessCommandLine contains "―sc daily" or ProcessCommandLine contains "-ri " or ProcessCommandLine contains "/ri " or ProcessCommandLine contains "–ri " or ProcessCommandLine contains "—ri " or ProcessCommandLine contains "―ri ") and (ProcessCommandLine contains "curl" or ProcessCommandLine contains "wget" or ProcessCommandLine contains "bitsadmin" or ProcessCommandLine contains "certutil" or ProcessCommandLine contains "rclone" or ProcessCommandLine contains "winscp" or ProcessCommandLine contains "Invoke-WebRequest" or ProcessCommandLine contains "Invoke-RestMethod" or ProcessCommandLine contains "Start-BitsTransfer" or ProcessCommandLine contains "WebClient"))

Splunk · SPL

Run this as a search.

index=* (Image="*\\schtasks.exe" AND (CommandLine="*-create*" OR CommandLine="*/create*" OR CommandLine="*–create*" OR CommandLine="*—create*" OR CommandLine="*―create*") AND (CommandLine="*-sc minute*" OR CommandLine="*/sc minute*" OR CommandLine="*–sc minute*" OR CommandLine="*—sc minute*" OR CommandLine="*―sc minute*" OR CommandLine="*-sc hourly*" OR CommandLine="*/sc hourly*" OR CommandLine="*–sc hourly*" OR CommandLine="*—sc hourly*" OR CommandLine="*―sc hourly*" OR CommandLine="*-sc daily*" OR CommandLine="*/sc daily*" OR CommandLine="*–sc daily*" OR CommandLine="*—sc daily*" OR CommandLine="*―sc daily*" OR CommandLine="*-ri *" OR CommandLine="*/ri *" OR CommandLine="*–ri *" OR CommandLine="*—ri *" OR CommandLine="*―ri *") AND (CommandLine="*curl*" OR CommandLine="*wget*" OR CommandLine="*bitsadmin*" OR CommandLine="*certutil*" OR CommandLine="*rclone*" OR CommandLine="*winscp*" OR CommandLine="*Invoke-WebRequest*" OR CommandLine="*Invoke-RestMethod*" OR CommandLine="*Start-BitsTransfer*" OR CommandLine="*WebClient*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\schtasks.exe" AND (TO_LOWER(process.command_line) LIKE "*-create*" OR TO_LOWER(process.command_line) LIKE "*/create*" OR TO_LOWER(process.command_line) LIKE "*–create*" OR TO_LOWER(process.command_line) LIKE "*—create*" OR TO_LOWER(process.command_line) LIKE "*―create*") AND (TO_LOWER(process.command_line) LIKE "*-sc minute*" OR TO_LOWER(process.command_line) LIKE "*/sc minute*" OR TO_LOWER(process.command_line) LIKE "*–sc minute*" OR TO_LOWER(process.command_line) LIKE "*—sc minute*" OR TO_LOWER(process.command_line) LIKE "*―sc minute*" OR TO_LOWER(process.command_line) LIKE "*-sc hourly*" OR TO_LOWER(process.command_line) LIKE "*/sc hourly*" OR TO_LOWER(process.command_line) LIKE "*–sc hourly*" OR TO_LOWER(process.command_line) LIKE "*—sc hourly*" OR TO_LOWER(process.command_line) LIKE "*―sc hourly*" OR TO_LOWER(process.command_line) LIKE "*-sc daily*" OR TO_LOWER(process.command_line) LIKE "*/sc daily*" OR TO_LOWER(process.command_line) LIKE "*–sc daily*" OR TO_LOWER(process.command_line) LIKE "*—sc daily*" OR TO_LOWER(process.command_line) LIKE "*―sc daily*" OR TO_LOWER(process.command_line) LIKE "*-ri *" OR TO_LOWER(process.command_line) LIKE "*/ri *" OR TO_LOWER(process.command_line) LIKE "*–ri *" OR TO_LOWER(process.command_line) LIKE "*—ri *" OR TO_LOWER(process.command_line) LIKE "*―ri *") AND (TO_LOWER(process.command_line) LIKE "*curl*" OR TO_LOWER(process.command_line) LIKE "*wget*" OR TO_LOWER(process.command_line) LIKE "*bitsadmin*" OR TO_LOWER(process.command_line) LIKE "*certutil*" OR TO_LOWER(process.command_line) LIKE "*rclone*" OR TO_LOWER(process.command_line) LIKE "*winscp*" OR TO_LOWER(process.command_line) LIKE "*invoke-webrequest*" OR TO_LOWER(process.command_line) LIKE "*invoke-restmethod*" OR TO_LOWER(process.command_line) LIKE "*start-bitstransfer*" OR TO_LOWER(process.command_line) LIKE "*webclient*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\schtasks\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(-create|/create|–create|—create|―create)</field>    <field name="CommandLine" type="pcre2">(?i)(-sc minute|/sc minute|–sc minute|—sc minute|―sc minute|-sc hourly|/sc hourly|–sc hourly|—sc hourly|―sc hourly|-sc daily|/sc daily|–sc daily|—sc daily|―sc daily|-ri |/ri |–ri |—ri |―ri )</field>    <field name="CommandLine" type="pcre2">(?i)(curl|wget|bitsadmin|certutil|rclone|winscp|Invoke-WebRequest|Invoke-RestMethod|Start-BitsTransfer|WebClient)</field>    <description>Scheduled task registered to run a recurring file transfer</description>    <mitre>      <id>T1029</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 1c2d8038-5d37-4ffa-a4f5-a7a1e8063d4c

ATT&CKT1029

T1029Scheduled Transfer

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

One process-creation event: schtasks.exe being run to register a task whose schedule repeats and whose action string mentions a file-transfer utility. Read that sentence again, because it is narrower than the title suggests. T1029 is about exfiltration that happens on a timer — the regularity is the whole technique. MITRE's analytic AN1118 says so: "recurring network exfiltration … exhibiting time-based regularity and consistent external destinations." Every word of that is a statement about many events compared to each other. This rule sees one event.

02 · Telemetry you need

Process creation with arguments. On Sysmon EventID 1 that is free. On
Nothing else. There is no network leg here, no correlation, no state.

03 · How the logic works

Four selections, all required (condition: all of selection*):

Why registration and not execution. MITRE's knobs — TimeWindow, DestIPAllowlist, ParentProcessBaseline — all describe cross-event correlation. Sigma has no time-window operator and no aggregation, so "the same destination, every day, at the same hour" cannot be written here at all. The author's move is to catch the one moment where the schedule and the transfer appear together in a single string: the command line that declares the recurrence. Recurrence is never measured; it is read off an argument. What that costs. A task registered through Register-ScheduledTask, the COM Task Scheduler API, or schtasks /XML produces no such command line, and the rule stays silent. So does an existing benign task repurposed to exfiltrate. The four-way AND is the fragile part. Every link is required, so the weakest one sets the strength of the whole rule. The reviewer's example is the one to remember: /tr "powershell -enc <base64>" is the most ordinary way to write a task action and contains none of the ten transfer terms. Neither do ftp.exe, scp.exe, a dropped Go binary, or python. The reviewer also noted that selection_recurrence stops at four schedule types — /sc weekly and /sc monthly are recurrence too, and a weekly upload is exactly the blend-with-normal-activity behaviour the technique describes. The direction problem — the most important thing on this page. Nothing in these four selections requires data to move outward. curl, wget, certutil -urlcache, bitsadmin and Start-BitsTransfer are used for downloads far more than uploads. The identical event fires on T1105 Ingress Tool Transfer, probably more often than on the exfiltration this rule is tagged for. What is actually being detected is scheduled-task creation (T1053.005) whose action mentions a transfer tool. That is a defensible Windows proxy for T1029 — but call it what it is when you triage.

04 · Common false positives

Backup, log-shipping and monitoring agents registering their own recurring
Scheduled ingress, not egress — vendor update checkers, AV definition
Unanchored substrings: curl, wget and rclone match a directory name or a

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0399 and never executed against a log line. level: medium is a judgement about a four-way AND being quiet, not a measured rate; there is no measurement.
tier_2: means confirming the audit policy is on, running it over historical schtasks volume, and naming your deployment tooling.
tier_3: restores what MITRE asked for: the task's executions joined to outbound flows over a TimeWindow, with direction established — correlation Sigma cannot carry, and the only way "scheduled" becomes measured rather than merely declared.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

`ParentProcessBaseline` (MITRE's knob), populated locally with whatever job
`DestIPAllowlist` (MITRE's knob) cannot be applied inside this rule; it is
Anchor the transfer terms (curl.exe, rclone.exe), add /sc weekly and

Declared by the author

Backup, log-shipping and monitoring agents that register their own recurring upload job at install time. A deployment script creating a daily rclone or curl task is byte-for-byte the same event as an operator scheduling exfiltration, and this is the single largest source of benign volume.
Administrators scheduling nightly report, inventory or log uploads with schtasks driving curl, bitsadmin or a PowerShell WebClient one-liner. MITRE's ParentProcessBaseline knob exists for exactly this, populated here by whatever job runners and provisioning tools the environment actually uses.
Software updaters and vendor maintenance tasks whose action string contains one of the transfer keywords for a legitimate reason, for example a certutil call that refreshes a certificate revocation list on a daily trigger.
The transfer keywords are unanchored substrings, so a task whose command line merely mentions a path or argument containing curl, wget or rclone matches without any transfer occurring.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1029, evaluated against their process_creation events.

Share this rule

/u/siemphony/1c2d8038-5d37-4ffa-a4f5-a7a1e8063d4c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Scheduled task registered to run a recurring file transfer

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it