Detectionmediumtest

Scheduled Task Executing Payload from Registry

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)Created Tue Jul 1886588b36-c6d3-465f-9cee-8f9093e07798windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        # schtasks.exe /Create /F /TN "{97F2F70B-10D1-4447-A2F3-9B070C86E261}" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\SOFTWARE\Pvoeooxf).yzbbvhhdypa))) " /SC MINUTE /MO 30
        - Image|endswith: '\schtasks.exe'
        - OriginalFileName: 'schtasks.exe'
    selection_cli_create:
        CommandLine|contains: '/Create'
    selection_cli_get:
        CommandLine|contains:
            - 'Get-ItemProperty'
            - ' gp ' # Alias
    selection_cli_hive:
        CommandLine|contains:
            - 'HKCU:'
            - 'HKLM:'
            - 'registry::'
            - 'HKEY_'
    filter_main_encoding:
        CommandLine|contains:
            - 'FromBase64String'
            - 'encodedcommand'
    condition: all of selection_* and not 1 of filter_*

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

thedfirreport.com

MITRE ATT&CK

Tactics

TA0004 · Privilege Escalation TA0002 · Execution TA0003 · Persistence

Sub-techniques

T1053.005 · Scheduled Task T1059.001 · PowerShell

Related Rules

DerivedDetectionhigh

Scheduled Task Executing Encoded Payload from Registry

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata

Rule ID

86588b36-c6d3-465f-9cee-8f9093e07798

Status

test

Level

medium

Type

Detection

Created

Tue Jul 18

Author

X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_schtasks_reg_loader.yml

Raw Tags

attack.privilege-escalationattack.executionattack.persistenceattack.t1053.005attack.t1059.001

View on GitHub