Detect a file-transfer utility launched by the task scheduler

Siemphony@siemphonymediumT1020unverified

Matches process creation where a dedicated file-transfer binary is started by a scheduled-task host — svchost.exe running the Schedule service on current Windows, taskeng.exe on the older builds that still have it. That parentage is the only part of AN1113 a single event carries: the analytic is about tools or scripts transmitting data to external destinations on a recurring interval, and Sigma expresses neither recurrence nor destination reputation, so MITRE's TimeWindow and DestinationIP knobs have no form here. What the rule can say is that the transfer was launched by automation rather than by a person, which is what separates automated exfiltration from the interactive case. Interpreters are deliberately absent from the child list — scheduled tasks legitimately run powershell.exe and cmd.exe constantly, and including them would bury the signal. Two telemetry caveats: the analytic's source is Security 4688, which requires the Audit Process Creation subcategory to be enabled, and the parent process name it reads is only populated on Windows 8.1 and Server 2012 R2 and later, so on older hosts the rule cannot match at all. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0397, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((InitiatingProcessFolderPath endswith "\\svchost.exe" or InitiatingProcessFolderPath endswith "\\taskeng.exe") and (FolderPath endswith "\\curl.exe" or FolderPath endswith "\\wget.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\ftp.exe" or FolderPath endswith "\\rclone.exe" or FolderPath endswith "\\scp.exe" or FolderPath endswith "\\sftp.exe" or FolderPath endswith "\\pscp.exe" or FolderPath endswith "\\psftp.exe" or FolderPath endswith "\\winscp.com" or FolderPath endswith "\\winscp.exe"))

Splunk · SPL

Run this as a search.

index=* ((ParentImage="*\\svchost.exe" OR ParentImage="*\\taskeng.exe") AND (Image="*\\curl.exe" OR Image="*\\wget.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\ftp.exe" OR Image="*\\rclone.exe" OR Image="*\\scp.exe" OR Image="*\\sftp.exe" OR Image="*\\pscp.exe" OR Image="*\\psftp.exe" OR Image="*\\winscp.com" OR Image="*\\winscp.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.parent.executable) LIKE "*\\\\svchost.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\taskeng.exe") AND (TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wget.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bitsadmin.exe" OR TO_LOWER(process.executable) LIKE "*\\\\ftp.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rclone.exe" OR TO_LOWER(process.executable) LIKE "*\\\\scp.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sftp.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pscp.exe" OR TO_LOWER(process.executable) LIKE "*\\\\psftp.exe" OR TO_LOWER(process.executable) LIKE "*\\\\winscp.com" OR TO_LOWER(process.executable) LIKE "*\\\\winscp.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\svchost\.exe$|\\taskeng\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\curl\.exe$|\\wget\.exe$|\\bitsadmin\.exe$|\\ftp\.exe$|\\rclone\.exe$|\\scp\.exe$|\\sftp\.exe$|\\pscp\.exe$|\\psftp\.exe$|\\winscp\.com$|\\winscp\.exe$)</field>    <description>Detect a file-transfer utility launched by the task scheduler</description>    <mitre>      <id>T1020</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c82b492b-5aee-4bd3-b35b-f136456f695a

ATT&CKT1020

T1020Automated Exfiltration

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

A dedicated file-transfer binary — curl, rclone, WinSCP, ftp, bitsadmin and friends — started by a Windows service host rather than by a person. The title says "launched by the task scheduler". Hold that claim loosely; most of this lesson is why it is not what the rule proves. AN1113 is about "automated tools or scripts periodically transmitting data to external destinations". Three words there — periodically, external, transmitting — are all outside what one process-creation event can say. Sigma has no recurrence operator, no destination field on process creation, and no direction of transfer. What survives is the parentage: automation started it.

02 · Telemetry you need

4688's parent-process field is only populated on Windows 8.1 / Server 2012 R2
The \taskeng.exe arm contradicts that caveat. taskeng.exe hosted scheduled
The analytic's other sources — Sysmon EID 3 and 22 — carry the destination. You

03 · How the logic works

`ParentImage|endswith: '\svchost.exe'` is not the task scheduler. It is every service host on the machine — BITS, WinRM, DCOM launch, Update Orchestrator, everything in netsvcs. The Schedule service is one tenant among dozens. The rule's fourth false positive admits this, but only after the title and first sentence have told the reader something stronger. Naming what the rule actually matches is the skill: "a file-transfer tool started by any Windows service". A discriminator exists on one feed only — Sysmon EID 1 carries ParentCommandLine, so -k netsvcs -p -s Schedule narrows the parent to the scheduler. Security 4688 has no ParentCommandLine at all, so on the feed the analytic names, the rule degrades to "any service" and stays there. Second thing to internalise: process creation records no direction. curl.exe or bitsadmin.exe under a service parent is at least as often ingress tool transfer (T1105) or ordinary patching as it is exfiltration — a package download looks exactly like an rclone upload at this log source. The rule is tagged attack.exfiltration, so on a given hit that attribution is more likely wrong than right, and a junior analyst handed "T1020 Automated Exfiltration" for a Windows Update fetch learns to distrust the whole ruleset. Direction has to come from the EID 3 leg — remote address, port, bytes sent versus received. Interpreters are excluded from the child list on purpose, and soundly: scheduled tasks run powershell.exe and cmd.exe constantly and would bury the signal. The cost is that most real automated exfiltration is a scheduled PowerShell one-liner with Invoke-WebRequest — which the corpus's T1029 rule catches at task-registration time instead. Deploy them together.

04 · Common false positives

Sanctioned scheduled transfers — nightly rclone or WinSCP backups, SFTP log
Monitoring tasks curling a health endpoint every few minutes, reproducing
Patching and software distribution — the direction problem made concrete.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0397 and never executed against logs.
tier_2: run it historically, then inventory which parent service each hit actually came from — that exercise teaches more about svchost.exe than any documentation.
tier_3: needs the EID 3 join for direction and destination plus a recurrence count; until both exist, treat a hit as "a machine moved a file" and go find out which way.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add ParentCommandLine|contains: 'Schedule' if you are on Sysmon; that alone converts "any service" back into the title's claim. Allow-list by task name and service account, not by dropping tools from the child list — the tools are the part with detection value.
MITRE's TimeWindow knob (recurrence) and DestinationIP knob (filter trusted destinations) both need the network leg and have no form here. The recurrence one is the whole analytic: a single transfer is nothing, the same transfer at 02:00 every night to the same external host is the finding.
Two coverage additions: the transfer list is the classic set and misses the cloud CLIs seen in current cases — azcopy.exe, aws.exe, MEGAcmd. And every term is a basename match, so renaming rclone.exe defeats it entirely.

Declared by the author

Sanctioned scheduled transfers. Nightly backups pushed with rclone or WinSCP, log shipping over SFTP and finance or EDI batch jobs using ftp.exe are the same event on the same schedule as the behaviour the analytic describes, and volume is the only thing that separates them — which this rule cannot see. Expect these to be the majority of hits and to need allow-listing by task and account before deployment.
Monitoring and health-check tasks that curl an endpoint every few minutes, which reproduce the recurring outbound pattern of MITRE's TimeWindow element exactly while moving almost no data.
Software distribution and patching, where a task started by the scheduler calls bitsadmin or curl to fetch a package. The direction is inbound rather than outbound, but process creation does not record it, so these match as readily as an upload does.
svchost.exe hosts far more than the Schedule service, so any Windows service that shells out to one of these binaries matches the parent selection too. The rule says automated, not specifically scheduled; confirm the launching task or service before treating a hit as exfiltration.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1020, evaluated against their process_creation events.

Share this rule

/u/siemphony/c82b492b-5aee-4bd3-b35b-f136456f695a

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect a file-transfer utility launched by the task scheduler

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it