Threat Huntlowtest
Scheduled Task Created - Registry
Detects the creation of a scheduled task via Registry keys.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Center for Threat Informed Defense (CTID) Summiting the Pyramid TeamCreated Wed Sep 2793ff0ceb-e0ef-4586-8cd8-a6c277d738e3windows
Hunting Hypothesis
Log Source
WindowsRegistry Event
ProductWindows← raw: windows
CategoryRegistry Event← raw: registry_event
Events for Windows Registry modifications including key creation, modification, and deletion.
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetObject|contains:
- '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\'
- '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\'
condition: selectionFalse Positives
Likely as this is a normal behaviour on Windows
MITRE ATT&CK
Sub-techniques
Software
CAR Analytics
2013-08-001 · CAR 2013-08-001
Other
detection.threat-hunting
Rule Metadata
Rule ID
93ff0ceb-e0ef-4586-8cd8-a6c277d738e3
Status
test
Level
low
Type
Threat Hunt
Created
Wed Sep 27
Path
rules-threat-hunting/windows/registry/registry_event/registry_event_scheduled_task_creation.yml
Raw Tags
attack.executionattack.persistenceattack.privilege-escalationattack.s0111attack.t1053.005car.2013-08-001detection.threat-hunting