{"id":"a8f29a7b-b137-4446-80a0-b804272f3da2","title":"Persistence and Execution at Scale via GPO Scheduled Task","description":"Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale","author":"Samir Bousseaden","status":"test","level":"high","date":"2019-04-03","modified":"2024-09-04","tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.lateral-movement","attack.t1053.005"],"technique_ids":["T1053.005"],"logsource":{"product":"windows","service":"security","definition":"The advanced audit policy setting \"Object Access > Audit Detailed File Share\" must be configured for Success/Failure"},"falsepositives":["If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduled tasks."],"references":["https://twitter.com/menasec1/status/1106899890377052160","https://www.secureworks.com/blog/ransomware-as-a-distraction","https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html"],"source_path":"rules/windows/builtin/security/win_security_gpo_scheduledtasks.yml","source_sha256":"e95a747bea74cb024ce0dd302dbc1c35d5a926f242d0f546d566557881234fb1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_gpo_scheduledtasks.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Persistence and Execution at Scale via GPO Scheduled Task\nid: a8f29a7b-b137-4446-80a0-b804272f3da2\nstatus: test\ndescription: Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale\nreferences:\n    - https://twitter.com/menasec1/status/1106899890377052160\n    - https://www.secureworks.com/blog/ransomware-as-a-distraction\n    - https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html\nauthor: Samir Bousseaden\ndate: 2019-04-03\nmodified: 2024-09-04\ntags:\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.persistence\n    - attack.lateral-movement\n    - attack.t1053.005\nlogsource:\n    product: windows\n    service: security\n    definition: 'The advanced audit policy setting \"Object Access > Audit Detailed File Share\" must be configured for Success/Failure'\ndetection:\n    selection_5136:\n        EventID: 5136\n        AttributeLDAPDisplayName:\n            - 'gPCMachineExtensionNames'\n            - 'gPCUserExtensionNames'\n        AttributeValue|contains:\n            - 'CAB54552-DEEA-4691-817E-ED4A4D1AFC72'\n            - 'AADCED64-746C-4633-A97C-D61349046527'\n    selection_5145:\n        EventID: 5145\n        ShareName|endswith: '\\SYSVOL' # looking for the string \\\\*\\SYSVOL\n        RelativeTargetName|endswith: 'ScheduledTasks.xml'\n        AccessList|contains:\n            - 'WriteData'\n            - '%%4417'\n    condition: 1 of selection_*\nfalsepositives:\n    - If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduled tasks.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","page":"techniques/enterprise/T1053.005/"}],"data_path":"data/detection-rules/a8f29a7b-b137-4446-80a0-b804272f3da2.json","kind":"sigma"}