Hide Schedule Task Via Index Value Tamper

Title: Hide Schedule Task Via Index Value Tamper
Status: test
Description:Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)
References:
  -https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-26
modified:2023-08-17
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains|all:
      -'\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\'
      -'Index'

    Details: 'DWORD (0x00000000)'
  condition:selection
Falsepositives:
  -Unlikely
Level: high