Suspicious Modification Of Scheduled Tasks

Title: Suspicious Modification Of Scheduled Tasks
Status: test
Description:Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload
References:
  -Internal Research
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-28
modified:2022-11-18
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.t1053.005'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:
      -' /Change '
      -' /TN '

  selection_susp_locations:
    CommandLine|contains:
      -'\AppData\Local\Temp'
      -'\AppData\Roaming\'
      -'\Users\Public\'
      -'\WINDOWS\Temp\'
      -'\Desktop\'
      -'\Downloads\'
      -'\Temporary Internet'
      -'C:\ProgramData\'
      -'C:\Perflogs\'
      -'%ProgramData%'
      -'%appdata%'
      -'%comspec%'
      -'%localappdata%'

  selection_susp_images:
    CommandLine|contains:
      -'regsvr32'
      -'rundll32'
      -'cmd /c '
      -'cmd /k '
      -'cmd /r '
      -'cmd.exe /c '
      -'cmd.exe /k '
      -'cmd.exe /r '
      -'powershell'
      -'mshta'
      -'wscript'
      -'cscript'
      -'certutil'
      -'bitsadmin'
      -'bash.exe'
      -'bash '
      -'scrcons'
      -'wmic '
      -'wmic.exe'
      -'forfiles'
      -'scriptrunner'
      -'hh.exe'
      -'hh '

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high