Threat Huntlowtest
Scheduled Task Created - FileCreation
Detects the creation of a scheduled task via file creation.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Center for Threat Informed Defense (CTID) Summiting the Pyramid TeamCreated Wed Sep 27a762e74f-4dce-477c-b023-4ed81df600f9windows
Hunting Hypothesis
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event
Events for file system activity including creation, modification, and deletion.
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetFilename|contains:
- ':\Windows\System32\Tasks\'
- ':\Windows\SysWOW64\Tasks\'
- ':\Windows\Tasks\'
condition: selectionFalse Positives
Normal behaviour on Windows
MITRE ATT&CK
Sub-techniques
Software
CAR Analytics
2013-08-001 · CAR 2013-08-001
Other
detection.threat-hunting
Rule Metadata
Rule ID
a762e74f-4dce-477c-b023-4ed81df600f9
Status
test
Level
low
Type
Threat Hunt
Created
Wed Sep 27
Path
rules-threat-hunting/windows/file/file_event/file_event_win_scheduled_task_creation.yml
Raw Tags
attack.executionattack.persistenceattack.privilege-escalationattack.t1053.005attack.s0111car.2013-08-001detection.threat-hunting