Scheduled Task by a Low Reputation Process

[rule]
description = """
Identifies the creation of a scheduled task by a process with low or unknown reputation. This behavior is consistent
with an adversary attempting to establish persistence after initial access via malicious user execution.
"""
id = "6fa88d6b-e4cf-4862-ad8e-7c7022773e74"
license = "Elastic License v2"
name = "Scheduled Task by a Low Reputation Process"
os_list = ["windows"]
reference = ["https://docs.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-"]
version = "1.0.7"

query = '''
sequence with maxspan=5m
 [process where event.action == "start" and
  (process.Ext.relative_file_creation_time <= 1800 or process.Ext.relative_file_name_modify_time <= 1800) and
  (process.code_signature.trusted == false or process.code_signature.exists == false) and
  not process.code_signature.status : "errorCode_endpoint*" and
  process.pe.imphash != "28a18f58924d2f4dd2bffbbc85a12952" and
  not process.hash.sha256 in ("fe2e331c46bd04e56d2417ff88ebce72675750aab701105086010a570f1afe62",
                             "81fac89743d43b741a009541a9c365ed3213f49cf6314d9c50418ab0d9e82528",
                             "5e68632b85501280c7378d20a287d40896243f1538e284d83f35f8b3aea98660",
                             "52e1e3053aadaccf78837dffaaa6f9ed41b201e0019f22a4880a5327d7650206",
                             "c67dc4d06f07584f4ac0f0b3882ae5f7479676014e6caa65eadc47f49d37ce13",
                             "c897af6b2f9d8a544e248862d975314478a75e6a3c5546fe643fb884afde44c6",
                             "63159f0a972d79169616f752dad5ccf79a9e468392eb9396fda34bc5cabebb3e",
                             "941f4d0a95fd0f32c484d30e3b14e4016e2a9f8bf9ea46ebc7f0f22dcdc10e25",
                             "1db9766f6583bb0e19b25df74de71c636893ea5a9b9e6421670667bb30e8d478",
                             "21864b1bd7dfa255eeb45ee8c10c15889a97afc45aed83190d91efca232d7db1")] by process.entity_id
 [file where event.action : "creation" and process.name : "svchost.exe" and
  file.path : ("?:\\Windows\\Tasks\\*", "?:\\Windows\\System32\\Tasks\\*")] by Effective_process.entity_id
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.005"
name = "Scheduled Task"
reference = "https://attack.mitre.org/techniques/T1053/005/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.10.0"