{"id":"f0767f15-0fb3-44b9-851e-e8d9a6d0005d","title":"Scheduled Task Executed Uncommon LOLBIN","description":"Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-12-05","modified":"2023-02-07","tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005"],"technique_ids":["T1053.005"],"logsource":{"product":"windows","service":"taskscheduler","definition":"Requirements: The \"Microsoft-Windows-TaskScheduler/Operational\" is disabled by default and needs to be enabled in order for this detection to trigger"},"falsepositives":["False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule"],"references":["Internal Research"],"source_path":"rules/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml","source_sha256":"1b7645f47e8f2cbf059c74c539d51e6e30f2a76b3920111313544129e5e0bf34","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Scheduled Task Executed Uncommon LOLBIN\nid: f0767f15-0fb3-44b9-851e-e8d9a6d0005d\nstatus: test\ndescription: Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task\nreferences:\n    - Internal Research\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-12-05\nmodified: 2023-02-07\ntags:\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.persistence\n    - attack.t1053.005\nlogsource:\n    product: windows\n    service: taskscheduler\n    definition: 'Requirements: The \"Microsoft-Windows-TaskScheduler/Operational\" is disabled by default and needs to be enabled in order for this detection to trigger'\ndetection:\n    selection:\n        EventID: 129 # Created Task Process\n        Path|endswith:\n            - '\\calc.exe'\n            - '\\cscript.exe'\n            - '\\mshta.exe'\n            - '\\mspaint.exe'\n            - '\\notepad.exe'\n            - '\\regsvr32.exe'\n            # - '\\rundll32.exe'\n            - '\\wscript.exe'\n    # filter_system:\n    #     Path|endswith: '\\rundll32.exe'\n    #     TaskName|startswith: '\\Microsoft\\Windows\\'\n    # condition: selection and not 1 of filter_*\n    condition: selection\nfalsepositives:\n    - False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","page":"techniques/enterprise/T1053.005/"}],"data_path":"data/detection-rules/f0767f15-0fb3-44b9-851e-e8d9a6d0005d.json","kind":"sigma"}