Name:Windows Scheduled Task XML Built Via Console Echo id:63081a3e-8546-4f2c-bd48-c7f96bb8ae14 version:1 date:None author:Onur Mustafa Erdogan, Splunk status:production type:TTP Description:The following analytic detects cmd.exe being used to write a Windows Scheduled Task XML definition to disk through the echo command.
This analytic focuses on command lines that combine echo with the Task Scheduler XML namespace. This is a significant activity because legitimate
software rarely assembles a task definition on the fly from the console. Browser hijackers and adware droppers do this to create a scheduled task,
through schtasks.exe and the generated XML file, that periodically relaunches a copy of themselves, and then delete the XML file to hinder forensic analysis.
If confirmed malicious, this could allow an attacker to establish persistence, repeatedly execute a payload and maintain control over the victim's browser.
Data_source:
-Sysmon EventID 1
-Windows Event Log Security 4688
-CrowdStrike ProcessRollup2
search:| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
from datamodel=Endpoint.Processes where
( Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe ) Processes.process="*echo *" Processes.process="*Task version=*" Processes.process="*xmlns=\"http://schemas.microsoft.com/windows/*"
how_to_implement:The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed
to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must
ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line
executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product.
The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model
(CIM) to normalize the field names and speed up the data modeling process. known_false_positives:False positives are not expected as building a scheduled task XML definition through echo on the command line is rare in legitimate
software. Some custom installers or administrative scripts that generate task definitions this way may trigger this detection. Filter
as needed based on the parent process. References: -https://www.joesandbox.com/analysis/1965188/0/html -https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking -https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-schema drilldown_searches: name:'View the detection results for - "$dest$" and "$user$"' search:'%original_detection_search% | search dest = "$dest$" user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$" and "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Browser Hijacking', 'Scheduled Tasks', 'Living Off The Land']
