Suspicious Schtasks Schedule Types

Title: Suspicious Schtasks Schedule Types
Status: test
Description:Detects scheduled task creations or modification on a suspicious schedule type
References:
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
  -http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-09
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.t1053.005'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
Image|endswith:'\schtasks.exe' OriginalFileName:'schtasks.exe'   selection_time:
    CommandLine|contains:
      -' ONLOGON '
      -' ONSTART '
      -' ONCE '
      -' ONIDLE '

  filter_privs:
    CommandLine|contains:
      -'NT AUT'
      -' SYSTEM'
      -'HIGHEST'

  condition:all of selection_* and not 1 of filter_*
Falsepositives:
  -Legitimate processes that run at logon. Filter according to your environment
Level: high