Detects scheduled tasks that execute Java JAR files, which is suspicious but not necessarily malicious

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Windows Scheduled Tasks to persistently execute Java JAR files, a technique often used to establish long-term footholds or deliver custom payloads while blending with legitimate application activity. Proactively hunting for this behavior in Azure Sentinel is critical because the execution of JAR files via scheduled tasks represents a high-fidelity indicator that can distinguish sophisticated lateral movement or persistence strategies from routine operational noise, enabling early detection before broader compromise occurs.

YARA Rule

rule SUSP_Scheduled_Task_Java_JAR_Aug25 {
   meta:
      description = "Detects scheduled tasks that execute Java JAR files, which is suspicious but not necessarily malicious"
      author = "Florian Roth"
      date = "2025-08-07"
      score = 60
      reference = "Internal Research"
      hash = "7c5999082d9c5f3dd342ca05191311ddd1e24ba7675d1e9763fb4d962be3a933"
      id = "b06df47a-529f-54d0-86ce-6739d45b4837"
   strings:
      $a0 = "<Task version=" wide
      $a1 = "xmlns=\"http://schemas.microsoft.com/windows/" wide

      $sa1 = "java.exe</Command>" wide
      $sa2 = "javaw.exe</Command>" wide

      $sb1 = "<Arguments>-jar " wide
   condition:
      uint16(0) == 0xfeff
      and filesize < 500KB
      and all of ($a*)
      and 1 of ($sa*)
      and 1 of ($sb*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects scheduled tasks that execute Java JAR files,” along with suggested filters or exclusions:

• Scenario: Enterprise Backup and Reporting Tools

  • Context: Legacy backup solutions (e.g., Veeam, Commvault) or custom reporting dashboards often rely on Java-based agents. These tools frequently create scheduled tasks to run nightly .jar files for data aggregation, log rotation, or report generation without user interaction.
  • Filter/Exclusion: Exclude specific task names containing keywords like Backup, Report, or Agent. Additionally, exclude paths where the executable is located in known vendor directories (e.g., C:\Program Files\Veeam\... or C:\ProgramData\Commvault\...\bin).

• Scenario: DevOps CI/CD Pipeline Agents

  • Context: Build servers like Jenkins, GitLab Runner, or TeamCity often install local agents on build nodes. These agents use scheduled tasks to trigger automated builds, execute unit tests, or deploy artifacts by invoking specific .jar files (e.g., jenkins-cli.jar, maven-runner.jar) at defined intervals.
  • Filter/Exclusion: Create an exclusion based on the parent process name being a known CI/CD service (e.g., java.exe, node.exe running under Jenkins Service). Filter for task paths residing in standard installation directories like C:\Program Files\jenkins\ or D:\ci-agents\.

• Scenario: Middleware and Message Queue Maintenance

  • Context: Enterprise middleware platforms such as Apache Kafka, RabbitMQ, or IBM MQ utilize Java for core operations. Scheduled tasks are often configured to execute .jar utilities for health checks, log compaction,