Detectionhightest

Suspicious Scheduled Task Update

Detects update to a scheduled task event that contain suspicious keywords.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Mon Dec 05614cf376-6651-47c4-9dcc-6b9527f749f4windows

Log Source

Windowssecurity

ProductWindows← raw: windows

Servicesecurity← raw: security

Definition

The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.

Detection Logic

detection:
    selection_eid:
        EventID: 4702
    selection_paths:
        TaskContentNew|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\Users\Public\'
            - '\WINDOWS\Temp\'
            - 'C:\Temp\'
            - '\Desktop\'
            - '\Downloads\'
            - '\Temporary Internet'
            - 'C:\ProgramData\'
            - 'C:\Perflogs\'
    selection_commands:
        TaskContentNew|contains:
            - 'regsvr32'
            - 'rundll32'
            - 'cmd.exe</Command>'
            - 'cmd</Command>'
            - '<Arguments>/c '
            - '<Arguments>/k '
            - '<Arguments>/r '
            - 'powershell'
            - 'pwsh'
            - 'mshta'
            - 'wscript'
            - 'cscript'
            - 'certutil'
            - 'bitsadmin'
            - 'bash.exe'
            - 'bash '
            - 'scrcons'
            - 'wmic '
            - 'wmic.exe'
            - 'forfiles'
            - 'scriptrunner'
            - 'hh.exe'
    condition: all of selection_*

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

learn.microsoft.com

MITRE ATT&CK

Tactics

TA0002 · Execution TA0004 · Privilege Escalation TA0003 · Persistence

Sub-techniques

T1053.005 · Scheduled Task

Related Rules

SimilarDetectionhigh

Suspicious Modification Of Scheduled Tasks

Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

614cf376-6651-47c4-9dcc-6b9527f749f4

Status

test

Level

high

Type

Detection

Created

Mon Dec 05

Author

Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/builtin/security/win_security_susp_scheduled_task_update.yml

Raw Tags

attack.executionattack.privilege-escalationattack.persistenceattack.t1053.005

View on GitHub