{"id":"dde85b37-40cd-4a94-b00c-0b8794f956b5","title":"Remote Task Creation via ATSVC Named Pipe - Zeek","description":"Detects remote task creation via at.exe or API interacting with ATSVC namedpipe","author":"Samir Bousseaden, @neu5rn","status":"test","level":"medium","date":"2020-04-03","modified":"2022-12-27","tags":["attack.privilege-escalation","attack.execution","attack.lateral-movement","attack.persistence","car.2013-05-004","car.2015-04-001","attack.t1053.002"],"technique_ids":["T1053.002"],"logsource":{"product":"zeek","service":"smb_files"},"falsepositives":["Unknown"],"references":["https://web.archive.org/web/20230409194125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html"],"source_path":"rules/network/zeek/zeek_smb_converted_win_atsvc_task.yml","source_sha256":"cd153533a5f9fff51203749821706ca85a223852ed0e02180941cea9661ed68f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/zeek/zeek_smb_converted_win_atsvc_task.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Remote Task Creation via ATSVC Named Pipe - Zeek\nid: dde85b37-40cd-4a94-b00c-0b8794f956b5\nrelated:\n    - id: f6de6525-4509-495a-8a82-1f8b0ed73a00\n      type: derived\nstatus: test\ndescription: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe\nreferences:\n    - https://web.archive.org/web/20230409194125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html\nauthor: 'Samir Bousseaden, @neu5rn'\ndate: 2020-04-03\nmodified: 2022-12-27\ntags:\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.lateral-movement\n    - attack.persistence\n    - car.2013-05-004\n    - car.2015-04-001\n    - attack.t1053.002\nlogsource:\n    product: zeek\n    service: smb_files\ndetection:\n    selection:\n        path: '\\\\\\*\\IPC$'\n        name: 'atsvc'\n        # Accesses: '*WriteData*'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1053.002","id":"T1053.002","name":"At","page":"techniques/enterprise/T1053.002/"}],"data_path":"data/detection-rules/dde85b37-40cd-4a94-b00c-0b8794f956b5.json","kind":"sigma"}