Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Renamed Jusched.EXE Execution

Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Markus Neis, SwisscomCreated Tue Jun 04Updated Fri Feb 03edd8a48c-1b9f-4ba1-83aa-490338cd1ccbwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection:
        Description:
            - Java Update Scheduler
            - Java(TM) Update Scheduler
    filter:
        Image|endswith: '\jusched.exe'
    condition: selection and not filter
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
bitdefender.com
MITRE ATT&CK
Rule Metadata
Rule ID
edd8a48c-1b9f-4ba1-83aa-490338cd1ccb
Status
test
Level
high
Type
Detection
Created
Tue Jun 04
Modified
Fri Feb 03
Author
Markus Neis, Swisscom
Path
rules/windows/process_creation/proc_creation_win_renamed_jusched.yml
Raw Tags
attack.executionattack.defense-evasionattack.t1036.003
View on GitHub