HackTool - Default PowerSploit/Empire Scheduled Task Creation

Title: HackTool - Default PowerSploit/Empire Scheduled Task Creation
Status: test
Description:Detects the creation of a schtask via PowerSploit or Empire Default Configuration.
References:
  -https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1
  -https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py
Author: Markus Neis, @Karneades
Date: 2018-03-06
modified:2023-03-03
Tags:

• -'attack.execution'
• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.s0111'
• -'attack.g0022'
• -'attack.g0060'
• -'car.2013-08-001'
• -'attack.t1053.005'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    ParentImage|endswith:
      -'\powershell.exe'
      -'\pwsh.exe'

    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:
      -'/Create'
      -'powershell.exe -NonI'
      -'/TN Updater /TR'

    CommandLine|contains:
      -'/SC ONLOGON'
      -'/SC DAILY /ST'
      -'/SC ONIDLE'
      -'/SC HOURLY'

  condition:selection
Falsepositives:
  -Unlikely
Level: high