Schtasks From Suspicious Folders

Title: Schtasks From Suspicious Folders
Status: test
Description:Detects scheduled task creations that have suspicious action command and folder combinations
References:
  -https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical
Author: Florian Roth (Nextron Systems)
Date: 2022-04-15
modified:2022-11-18
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.t1053.005'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
Image|endswith:'\schtasks.exe' OriginalFileName:'schtasks.exe'   selection_create:
    CommandLine|contains: ' /create '
  selection_command:
    CommandLine|contains:
      -'powershell'
      -'pwsh'
      -'cmd /c '
      -'cmd /k '
      -'cmd /r '
      -'cmd.exe /c '
      -'cmd.exe /k '
      -'cmd.exe /r '

  selection_all_folders:
    CommandLine|contains:
      -'C:\ProgramData\'
      -'%ProgramData%'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high