Scheduled Task Executed Uncommon LOLBIN — Sigma Rule

Rule metadata and linked tags

Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: medium. Source dates: 2022-12-05 / 2023-02-07.

{
  "product": "windows",
  "service": "taskscheduler",
  "definition": "Requirements: The \"Microsoft-Windows-TaskScheduler/Operational\" is disabled by default and needs to be enabled in order for this detection to trigger"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 1b7645f47e8f2cbf059c74c539d51e6e30f2a76b3920111313544129e5e0bf34

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Scheduled Task Executed Uncommon LOLBIN
id: f0767f15-0fb3-44b9-851e-e8d9a6d0005d
status: test
description: Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-05
modified: 2023-02-07
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
logsource:
    product: windows
    service: taskscheduler
    definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
    selection:
        EventID: 129 # Created Task Process
        Path|endswith:
            - '\calc.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\mspaint.exe'
            - '\notepad.exe'
            - '\regsvr32.exe'
            # - '\rundll32.exe'
            - '\wscript.exe'
    # filter_system:
    #     Path|endswith: '\rundll32.exe'
    #     TaskName|startswith: '\Microsoft\Windows\'
    # condition: selection and not 1 of filter_*
    condition: selection
falsepositives:
    - False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule
level: medium

Original YAML and metadata in JSON

False positives

• False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule

Source references

• Internal Research (source note; no public URL supplied)