{"id":"4720b7df-40c3-48fd-bbdf-fd4b3c464f0d","title":"Scheduled TaskCache Change by Uncommon Program","description":"Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious","author":"Syed Hasan (@syedhasan009)","status":"test","level":"high","date":"2021-06-18","modified":"2025-10-22","tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053","attack.t1053.005"],"technique_ids":["T1053","T1053.005"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Unknown"],"references":["https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/","https://labs.f-secure.com/blog/scheduled-task-tampering/"],"source_path":"rules/windows/registry/registry_set/registry_set_taskcache_entry.yml","source_sha256":"c71c0b04d43485188716bcd426376e2c1017009040241c4a76777b87322d16d9","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_taskcache_entry.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Scheduled TaskCache Change by Uncommon Program\nid: 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d\nstatus: test\ndescription: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious\nreferences:\n    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/\n    - https://labs.f-secure.com/blog/scheduled-task-tampering/\nauthor: Syed Hasan (@syedhasan009)\ndate: 2021-06-18\nmodified: 2025-10-22\ntags:\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.persistence\n    - attack.t1053\n    - attack.t1053.005\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|contains: 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\'\n    filter_main_empty:\n        Details: '(Empty)'\n    filter_main_null:\n        Details: null\n    filter_main_other:\n        TargetObject|contains:\n            - 'Microsoft\\Windows\\UpdateOrchestrator'\n            - 'Microsoft\\Windows\\SoftwareProtectionPlatform\\SvcRestartTask\\Index'\n            - 'Microsoft\\Windows\\Flighting\\OneSettings\\RefreshCache\\Index'\n    filter_main_mousocoreworker:\n        Image|endswith: 'C:\\Windows\\System32\\MoUsoCoreWorker.exe'\n    filter_main_services:\n        Image|endswith: 'C:\\Windows\\System32\\services.exe'\n    filter_main_tiworker:\n        Image|startswith: 'C:\\Windows\\'\n        Image|endswith: '\\TiWorker.exe'\n    filter_main_svchost:\n        Image: 'C:\\WINDOWS\\system32\\svchost.exe'\n    filter_main_ngen:\n        Image|startswith: 'C:\\Windows\\Microsoft.NET\\Framework' # \\Framework\\ and \\Framework64\\\n        Image|endswith: '\\ngen.exe'\n        TargetObject|contains:\n            - '\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{B66B135D-DA06-4FC4-95F8-7458E1D10129}'\n            - '\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows\\.NET Framework\\.NET Framework NGEN'\n    filter_main_office:\n        Image:\n            - 'C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe'\n            - 'C:\\Program Files (x86)\\Microsoft Office\\root\\Integration\\Integrator.exe'\n            - 'C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe'\n            - 'C:\\Program Files (x86)\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe'\n    filter_main_msiexec:\n        Image: 'C:\\Windows\\System32\\msiexec.exe'\n    filter_main_explorer:\n        Image: 'C:\\Windows\\explorer.exe'\n        TargetObject|contains: '\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows\\PLA\\Server Manager Performance Monitor\\'\n    filter_main_system:\n        Image: 'System'\n    filter_main_runtimebroker:\n        Image: 'C:\\Windows\\System32\\RuntimeBroker.exe'\n    filter_optional_dropbox_updater:\n        Image:\n            - 'C:\\Program Files (x86)\\Dropbox\\Update\\DropboxUpdate.exe'\n            - 'C:\\Program Files\\Dropbox\\Update\\DropboxUpdate.exe'\n    filter_optional_edge:\n        Image|endswith:\n            - 'C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe'\n            - 'C:\\Program Files\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe'\n    filter_optional_onedrive:\n        Image|endswith:\n            - 'C:\\Program Files (x86)\\Microsoft OneDrive\\OneDrive.exe'\n            - 'C:\\Program Files\\Microsoft OneDrive\\OneDrive.exe'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1053","id":"T1053","name":"Scheduled Task/Job","page":"techniques/enterprise/T1053/"},{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","page":"techniques/enterprise/T1053.005/"}],"data_path":"data/detection-rules/4720b7df-40c3-48fd-bbdf-fd4b3c464f0d.json","kind":"sigma"}