Remote Task Creation via ATSVC Named Pipe - Zeek

Title: Remote Task Creation via ATSVC Named Pipe - Zeek
Status: test
Description:Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
References:
  -https://web.archive.org/web/20230409194125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html
Author: Samir Bousseaden, @neu5rn
Date: 2020-04-03
modified:2022-12-27
Tags:

• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.lateral-movement'
• -'attack.persistence'
• -'car.2013-05-004'
• -'car.2015-04-001'
• -'attack.t1053.002'

Logsource:

• product: zeek
• service: smb_files

Detection:
  selection:
    path: '\\\*\IPC$'
    name: 'atsvc'
  condition:selection
Falsepositives:
  -Unknown
Level: medium