Uncommon One Time Only Scheduled Task At 00:00

Title: Uncommon One Time Only Scheduled Task At 00:00
Status: test
Description:Detects scheduled task creation events that include suspicious actions, and is run once at 00:00
References:
  -https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
Author: pH-T (Nextron Systems)
Date: 2022-07-15
modified:2023-02-03
Tags:

• -'attack.execution'
• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1053.005'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|contains:'\schtasks.exe' OriginalFileName:'schtasks.exe'   selection_cli:
    CommandLine|contains:
      -'wscript'
      -'vbscript'
      -'cscript'
      -'wmic '
      -'wmic.exe'
      -'regsvr32.exe'
      -'powershell'
      -'\AppData\'

  selection_time:
    CommandLine|contains|all:
      -'once'
      -'00:00'

  condition:all of selection_*
Falsepositives:
  -Software installation
Level: high