Disclosed hacktool set - file tasksvr.exe

Hunt Hypothesis

This hunt detects adversaries leveraging the legitimate Windows utility tasksvr.exe as a disclosed hacktool to execute malicious payloads or establish persistence within the environment. Proactive hunting for this behavior in Azure Sentinel is critical because attackers often abuse trusted system processes like tasksvr.exe to evade signature-based detection and maintain stealthy access to sensitive resources.

YARA Rule

rule Hacktools_CN_Panda_tasksvr {
	meta:
		description = "Disclosed hacktool set - file tasksvr.exe"
		author = "Florian Roth"
		date = "17.11.14"
		score = 60
		hash = "a73fc74086c8bb583b1e3dcfd326e7a383007dc0"
	strings:
		$s2 = "Consys21.dll" fullword ascii
		$s4 = "360EntCall.exe" fullword wide
		$s15 = "Beijing1" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set - file tasksvr.exe detection rule, including suggested filters and exclusions:

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Software Deployment

  • Context: The SCCM client service (ccmexec.exe) often invokes tasksvr.exe to execute scheduled software installations or patching tasks on endpoint machines. This is a standard administrative workflow where the deployment engine uses the Task Scheduler service to manage execution windows.
  • Filter/Exclusion: Exclude processes where the parent process name is ccmexec.exe and the command line contains arguments related to “SoftwareInstallation” or “PatchDeployment”.

• Scenario: Automated Backup Jobs via Veeam or Commvault

  • Context: Enterprise backup solutions like Veeam Agent for Microsoft Windows or Commvault often utilize the native Task Scheduler (tasksvr.exe) to trigger incremental backups during off-hours. The detection may flag the creation of a new scheduled task or the execution of an existing one as a potential hacktool activity.
  • Filter/Exclusion: Create an exclusion rule for tasksvr.exe instances where the parent process is VeeamAgentService.exe, vssnap.exe, or commagent.exe.

• Scenario: Group Policy (GPO) Script Execution

  • Context: When a new Group Policy Object containing startup scripts or logon scripts is applied, the system may dynamically create or modify tasks via tasksvr.exe to ensure script execution. This is common during domain-wide policy updates or user provisioning events.
  • Filter/Exclusion: Filter out alerts where the initiating process is gpupdate.exe or lsass.exe (indicating a GPO refresh) and the action type is “Create” or “Update”