Name:Randomly Generated Scheduled Task Name id:9d22a780-5165-11ec-ad4f-3e22fbd008af version:10 date:None author:Mauricio Velazco, Splunk status:experimental type:Hunting Description:The following analytic detects the creation of a Scheduled Task with a high entropy, randomly generated name, leveraging Event ID 4698. It uses the `ut_shannon` function from the URL ToolBox Splunk application to measure the entropy of the Task Name. This activity is significant as adversaries often use randomly named Scheduled Tasks for lateral movement and remote code execution, employing tools like Impacket or CrackMapExec. If confirmed malicious, this could allow attackers to execute arbitrary code remotely, potentially leading to further compromise and persistence within the network. Data_source:
how_to_implement:To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also required. known_false_positives:Legitimate applications may use random Scheduled Task names. References: -https://attack.mitre.org/techniques/T1053/005/ -https://splunkbase.splunk.com/app/2734/ -https://en.wikipedia.org/wiki/Entropy_(information_theory) drilldown_searches:
: analytic_story:['Active Directory Lateral Movement', 'CISA AA22-257A', 'Scheduled Tasks', '0bj3ctivity Stealer']
