{"id":"3a734d25-df5c-4b99-8034-af1ddb5883a4","title":"Suspicious Scheduled Task Creation","description":"Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-05","modified":"2022-12-07","tags":["attack.execution","attack.privilege-escalation","attack.persistence","attack.t1053.005"],"technique_ids":["T1053.005"],"logsource":{"product":"windows","service":"security","definition":"The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data."},"falsepositives":["Unknown"],"references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"],"source_path":"rules/windows/builtin/security/win_security_susp_scheduled_task_creation.yml","source_sha256":"0351c4d3781057a81e1312fb947d27d18685b4683e6a4ff473e23b5a0df34888","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_scheduled_task_creation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Scheduled Task Creation\nid: 3a734d25-df5c-4b99-8034-af1ddb5883a4\nstatus: test\ndescription: Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.\nreferences:\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-12-05\nmodified: 2022-12-07\ntags:\n    - attack.execution\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1053.005\nlogsource:\n    product: windows\n    service: security\n    definition: 'The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.'\ndetection:\n    selection_eid:\n        EventID: 4698\n    selection_paths:\n        TaskContent|contains:\n            - '\\AppData\\Local\\Temp\\'\n            - '\\AppData\\Roaming\\'\n            - '\\Users\\Public\\'\n            - '\\WINDOWS\\Temp\\'\n            - 'C:\\Temp\\'\n            - '\\Desktop\\'\n            - '\\Downloads\\'\n            - '\\Temporary Internet'\n            - 'C:\\ProgramData\\'\n            - 'C:\\Perflogs\\'\n    selection_commands:\n        TaskContent|contains:\n            - 'regsvr32'\n            - 'rundll32'\n            - 'cmd.exe</Command>'\n            - 'cmd</Command>'\n            - '<Arguments>/c '\n            - '<Arguments>/k '\n            - '<Arguments>/r '\n            - 'powershell'\n            - 'pwsh'\n            - 'mshta'\n            - 'wscript'\n            - 'cscript'\n            - 'certutil'\n            - 'bitsadmin'\n            - 'bash.exe'\n            - 'bash '\n            - 'scrcons'\n            - 'wmic '\n            - 'wmic.exe'\n            - 'forfiles'\n            - 'scriptrunner'\n            - 'hh.exe'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","page":"techniques/enterprise/T1053.005/"}],"data_path":"data/detection-rules/3a734d25-df5c-4b99-8034-af1ddb5883a4.json","kind":"sigma"}