Name:Schedule Task with Rundll32 Command Trigger id:75b00fd8-a0ff-11eb-8b31-acde48001122 version:4 date:2024-11-28 author:Teoderick Contreras, Splunk status:production type:TTP Description:The following analytic detects the creation of scheduled tasks in Windows that use the rundll32 command. It leverages Windows Security EventCode 4698, which logs the creation of scheduled tasks, and filters for tasks executed via rundll32. This activity is significant as it is a common technique used by malware, such as TrickBot, to persist in an environment or deliver additional payloads. If confirmed malicious, this could lead to data theft, ransomware deployment, or other damaging outcomes. Immediate investigation and mitigation are crucial to prevent further compromise. Data_source:
-Windows Event Log Security 4698
search:`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN ("*rundll32*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schedule_task_with_rundll32_command_trigger_filter`
how_to_implement:To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. known_false_positives:unknown References: -https://labs.vipre.com/trickbot-and-its-modules/ -https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/ drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Windows Persistence Techniques' - 'Living Off The Land' - 'IcedID' - 'Scheduled Tasks' - 'Compromised Windows Host' - 'Trickbot' asset_type:Endpoint confidence:100 impact:70 message:A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$ mitre_attack_id: - 'T1053' observable: name:'dest' type:'Hostname' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'dest' - 'Task_Name' - 'Command' - 'Author' - 'Enabled' - 'Hidden' - 'Arguments' risk_score:70 security_domain:endpoint
