Task Schedulder Local Exploit - Windows local priv-esc using Task Scheduler, published by webDevil. Supports Windows 7 a

Hunt Hypothesis

This hunt hypothesis detects adversaries leveraging a known Task Scheduler vulnerability to execute arbitrary code and escalate privileges from a standard user context to local administrator on Windows systems. Proactively hunting for this behavior in Azure Sentinel is critical because successful exploitation grants attackers immediate control over the host, enabling lateral movement and persistence that could compromise the entire environment if left undetected.

YARA Rule

rule iKAT_priv_esc_tasksch {
	meta:
		description = "Task Schedulder Local Exploit - Windows local priv-esc using Task Scheduler, published by webDevil. Supports Windows 7 and Vista."
		author = "Florian Roth"
		date = "05.11.14"
		score = 75
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		hash = "84ab94bff7abf10ffe4446ff280f071f9702cf8b"
	strings:
		$s0 = "objShell.Run \"schtasks /change /TN wDw00t /disable\",,True" fullword ascii
		$s3 = "objShell.Run \"schtasks /run /TN wDw00t\",,True" fullword ascii
		$s4 = "'objShell.Run \"cmd /c copy C:\\windows\\system32\\tasks\\wDw00t .\",,True" fullword ascii
		$s6 = "a.WriteLine (\"schtasks /delete /f /TN wDw00t\")" fullword ascii
		$s7 = "a.WriteLine (\"net user /add ikat ikat\")" fullword ascii
		$s8 = "a.WriteLine (\"cmd.exe\")" fullword ascii
		$s9 = "strFileName=\"C:\\windows\\system32\\tasks\\wDw00t\"" fullword ascii
		$s10 = "For n = 1 To (Len (hexXML) - 1) step 2" fullword ascii
		$s13 = "output.writeline \" Should work on Vista/Win7/2008 x86/x64\"" fullword ascii
		$s11 = "Set objExecObject = objShell.Exec(\"cmd /c schtasks /query /XML /TN wDw00t\")" fullword ascii
		$s12 = "objShell.Run \"schtasks /create /TN wDw00t /sc monthly /tr \"\"\"+biatchFile+\"" ascii
		$s14 = "a.WriteLine (\"net localgroup administrators /add v4l\")" fullword ascii
		$s20 = "Set ts = fso.createtextfile (\"wDw00t.xml\")" fullword ascii
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 13 string patterns in its detection logic.

References

• http://ikat.ha.cked.net/Windows/functions/ikatfiles.html
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Task Scheduler Local Exploit detection rule, including suggested filters or exclusions:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: Enterprise Configuration Management tools (e.g., Microsoft Endpoint Manager, SCCM) frequently create scheduled tasks to install updates or run post-installation scripts. These tasks often execute msiexec.exe or PowerShell scripts with elevated privileges from the C:\Windows\Tasks directory, mimicking the behavior of a local privilege escalation attack.
  • Filter/Exclusion: Exclude events where the Parent Process Name is ccmsetup.exe, IntuneAgent.exe, or msiexec.exe and the Task Path resides within C:\Windows\Tasks.

• Scenario: Antivirus Scheduled Scans (e.g., CrowdStrike, Defender)

  • Context: Endpoint Protection platforms like CrowdStrike Falcon or Microsoft Defender for Endpoint create background tasks to perform scheduled scans or update definitions. These processes often spawn child processes via the Task Scheduler service (svchost.exe or taskeng.exe) with high-privilege tokens, which can trigger the rule’s logic regarding task creation and execution.
  • Filter/Exclusion: Create a filter to ignore events where the Task Name contains keywords like “Defender”, “CrowdStrike”, “Falcon”, or “Scan” and the User Account is SYSTEM or a dedicated service account (e.g., svc_antivirus).

• Scenario: IT Automation Scripts for User Onboarding/Offboarding

  • Context: Internal DevOps or Identity teams often use PowerShell scripts (PowerShell.exe) wrapped in scheduled tasks to automate user provisioning, group policy updates, or software deployment. These scripts are typically triggered by the SYSTEM account and execute from