{"id":"1c0e41cd-21bb-4433-9acc-4a2cd6367b9b","title":"Suspicious Modification Of Scheduled Tasks","description":"Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location\nAttackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on\nInstead they modify the task after creation to include their malicious payload\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-28","modified":"2022-11-18","tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1053.005"],"technique_ids":["T1053.005"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["Internal Research","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks"],"source_path":"rules/windows/process_creation/proc_creation_win_schtasks_change.yml","source_sha256":"0388c33b7cc1bf996ca359c972cb26aaef48724dd24a3d803f4cf59552514917","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_schtasks_change.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Modification Of Scheduled Tasks\nid: 1c0e41cd-21bb-4433-9acc-4a2cd6367b9b\nrelated:\n    - id: 614cf376-6651-47c4-9dcc-6b9527f749f4 # Security-Audting Eventlog\n      type: similar\nstatus: test\ndescription: |\n    Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location\n    Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on\n    Instead they modify the task after creation to include their malicious payload\nreferences:\n    - Internal Research\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-07-28\nmodified: 2022-11-18\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.execution\n    - attack.t1053.005\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_schtasks:\n        Image|endswith: '\\schtasks.exe'\n        CommandLine|contains|all:\n            - ' /Change '\n            - ' /TN '\n    selection_susp_locations:\n        CommandLine|contains:\n            - '\\AppData\\Local\\Temp'\n            - '\\AppData\\Roaming\\'\n            - '\\Users\\Public\\'\n            - '\\WINDOWS\\Temp\\'\n            - '\\Desktop\\'\n            - '\\Downloads\\'\n            - '\\Temporary Internet'\n            - 'C:\\ProgramData\\'\n            - 'C:\\Perflogs\\'\n            - '%ProgramData%'\n            - '%appdata%'\n            - '%comspec%'\n            - '%localappdata%'\n    selection_susp_images:\n        CommandLine|contains:\n            - 'regsvr32'\n            - 'rundll32'\n            - 'cmd /c '\n            - 'cmd /k '\n            - 'cmd /r '\n            - 'cmd.exe /c '\n            - 'cmd.exe /k '\n            - 'cmd.exe /r '\n            - 'powershell'\n            - 'mshta'\n            - 'wscript'\n            - 'cscript'\n            - 'certutil'\n            - 'bitsadmin'\n            - 'bash.exe'\n            - 'bash '\n            - 'scrcons'\n            - 'wmic '\n            - 'wmic.exe'\n            - 'forfiles'\n            - 'scriptrunner'\n            - 'hh.exe'\n            - 'hh '\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","page":"techniques/enterprise/T1053.005/"}],"data_path":"data/detection-rules/1c0e41cd-21bb-4433-9acc-4a2cd6367b9b.json","kind":"sigma"}