Name:Schedule Task with HTTP Command Arguments id:523c2684-a101-11eb-916b-acde48001122 version:4 date:2024-11-28 author:Teoderick Contreras, Splunk status:production type:TTP Description:The following analytic detects the creation of scheduled tasks on Windows systems that include HTTP command arguments, using Windows Security EventCode 4698. It identifies tasks registered via schtasks.exe or TaskService with HTTP in their command arguments. This behavior is significant as it often indicates malware activity or the use of Living off the Land binaries (lolbins) to download additional payloads. If confirmed malicious, this activity could lead to data exfiltration, malware propagation, or unauthorized access to sensitive information, necessitating immediate investigation and mitigation. Data_source:
-Windows Event Log Security 4698
search:`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN ("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schedule_task_with_http_command_arguments_filter`
how_to_implement:To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. known_false_positives:unknown References: -https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Windows Persistence Techniques' - 'Living Off The Land' - 'Compromised Windows Host' - 'Scheduled Tasks' - 'Winter Vivern' asset_type:Endpoint confidence:90 impact:70 message:A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$ mitre_attack_id: - 'T1053' observable: name:'dest' type:'Hostname' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'dest' - 'Task_Name' - 'Command' - 'Author' - 'Enabled' - 'Hidden' - 'Arguments' risk_score:63 security_domain:endpoint
