Detection rules › Elastic

Scheduled Task Creation by an Unusual Process

Time window
5m
Sequence by
Effective_process.entity_id, process.entity_id
Source
github.com/elastic/protections-artifacts

Identifies the creation of a scheduled task by an unusual process such as script interpreters or recently dropped unsigned executables. This behavior is consistent with an adversary attempting to establish persistence.

MITRE ATT&CK coverage

Rule body

[rule]
description = """
Identifies the creation of a scheduled task by an unusual process such as script interpreters or recently dropped
unsigned executables. This behavior is consistent with an adversary attempting to establish persistence.
"""
id = "cb5fdbe3-84fa-4277-a967-1ffc0e8d3d25"
license = "Elastic License v2"
name = "Scheduled Task Creation by an Unusual Process"
os_list = ["windows"]
reference = [
    "https://docs.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-",
    "https://www.elastic.co/security-labs/dipping-into-danger",
    "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
]
version = "1.0.44"

query = '''
sequence with maxspan=5m
   [process where event.action == "start" and
    (
     /* common initial access processes */
     process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
                     "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe","RegSvcs.exe",
                     "msxsl.exe", "xwizard.exe", "csc.exe", "winword.exe", "excel.exe", "powerpnt.exe",
                     "powershell.exe")  or

     (process.name : "javaw.exe" and process.args : "-jar" and process.args_count == 3 and
      process.args : ("?:\\Users\\*", "?:\\ProgramData\\*")) or

    /* unsigned or untrusted codesign */
    ((process.code_signature.trusted == false or process.code_signature.exists == false) and
      (process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and
      not process.code_signature.status : ("errorTimeStamp", "errorCode_endpoint*", "errorExpired", "errorChaining")) or

    /* common abused paths */
    (process.executable :
         ("?:\\Users\\Public\\*",
          "?:\\Users\\*\\AppData\\Roaming\\*",
          "?:\\ProgramData\\*",
          "?:\\Windows\\Microsoft.NET\\*",
          "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
          "?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
          "?:\\Users\\*\\AppData\\Local\\Temp\\Rar*",
          "?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*",
          "\\Device\\CdRom*") and not process.code_signature.trusted == true) or

    /* execution from a mounted device */
    (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*")
    ) and

    /* known FPs */
    not (process.name : "rundll32.exe" and process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and process.parent.name : "msiexec.exe") and
    not (process.name : ("rundll32.exe", "regsvr32.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
    not (process.code_signature.trusted == true and process.executable : ("?:\\Users\\*\\AppData\\Roaming\\*", "?:\\ProgramData\\*")) and
    not (process.name : "rundll32.exe" and process.args : "tsworkspace,TaskUpdateWorkspaces") and
    not (process.name : "rundll32.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and process.command_line : "*pcrpf.dll,NotifyFirmwareUpdateStaged*") and
    not (process.executable : "\\Device\\Mup\\*\\OneDriveSetup.exe" and process.args : "/ALLUSERS") and
    not (process.name : "rundll32.exe" and
         process.command_line : ("*PWMTR32V.dll,InitializeSettingsDuringInstallation*", "*RunDll_EnableBits*")) and
    not (process.name : "powershell.exe" and
         process.command_line :
                   ("*:\\Program Files\\*", "*:\\Program Files (X86)\\*",
                    "*Packages\\Plugins\\Microsoft.AdminCenter.AdminCenter*",
                    "*:\\WINDOWS\\ccmcache\\*",
                    "*EEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBGADgAQQBjAHcA*",
                    "*UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAA*",
                    "*-EncodedCommand*",
                    "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ")) and
    not (process.name : "powershell.exe" and
         process.parent.executable : ("?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
                                      "?:\\Program Files (x86)\\Spiceworks Agent Shell\\AgentShellService.exe",
                                      "?:\\Program Files (x86)\\ITSPlatform\\plugin\\scripting\\platform-scripting-plugin.exe",
                                      "?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
                                      "?:\\Program Files (x86)\\Lenovo\\VantageService\\*\\Lenovo.Vantage.AddinInstaller.exe",
                                      "?:\\ProgramData\\Lenovo\\LenovoNow\\Downloads\\LenovoNow.Updater.exe",
                                      "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoFirstRunExperiencePackage\\x86\\LenovoWelcomeTask.exe",
                                      "?:\\Program Files (x86)\\Microsoft Intune Management Extension\\agentexecutor.exe",
                                      "C:\\Banyan\\Canopy\\Leaf\\leaf_desktop_app.exe",
                                      "?:\\windows\\system32\\msiexec.exe",
                                      "?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
                                      "C:\\Windows\\CCM\\OSDRunPowerShellScript.exe",
                                      "C:\\Windows\\System32\\runonce.exe")) and
    not (process.name : "powershell.exe" and user.id : "S-1-5-18") and
    not (process.name : "powershell.exe" and process.parent.name : "powershell.exe" and process.parent.args : "-EncodedCommand" and process.parent.args : "cABvAHcAZQByAHMAaABlAGw*") and
    not (process.name : "powershell.exe" and process.args : ("-nomeAgente", "\\\\*\\*.ps1", "& 'C:\\oracle_unified_agent\\scripts\\unified-agent-permissions.ps1' ; exit $($LASTEXITCODE)")) and
    not (process.parent.name : "rundll32.exe" and process.parent.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*") and
    not (process.name : "rundll32.exe" and process.command_line : ("*zzzzInvokeManagedCustomActionOutOfProc*", "*tsworkspace,WorkspaceSilentSetup*")) and
    not process.executable :
                ("?:\\Program Files (x86)\\*.exe",
                 "?:\\Program Files\\*.exe",
                 "?:\\Windows\\SysWOW64\\OneDriveSetup.exe",
                 "?:\\Windows\\System32\\MRT.exe",
                 "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe",
                 "C:\\Windows\\SystemTemp\\SupportAssistAgent\\*\\SupportAssistDeployment.exe") and
    /* DOCs opened from network file share trigger an office default scheduled task */
    not (process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and not process.working_directory : "C:\\*") and
    not process.hash.sha256 :
                  ("3d95157908cee58d19193c93c5f2b0a06910b8123a4211b0ea059ff66f2506e0",
                   "79dbc3cf0d4cdc0f2150ab5e2bf3457ba54297202500f26f1a1d48e455f7c54a",
                   "62d96982e2c2d58682471af9a9d0727ba49199d48b7766c318886e8e7e23670a",
                   "ef330f95416162866f5d8b9cd509066ab4168cfcc66e305006be1952905d47e6",
                   "cf635f97d0a3bea30f348277777f36db6b14aea0e7711471e5fb2e13167b80cd",
                   "3c1169568774b7ce8a96e137983b059f030eb3983c369cfb12ea2c59cf3f56ad",
                   "edaf602006b53dc936a35d0f9e6de51c552c0203ebe814cb68b1d5cbc81f4b49",
                   "82c97648fa358c31fb47e44762938738ad3080880b84b69d9c303d708ab160c2",
                   "4aff93803f1915f3a10f19a1d1e065483c4d11221e3c2792b3de1807c7bf1d9a",
                   "f9e86b3a6275429f5dbecccc2020e498032a96fc02dd8bdb2a1cc5b5bf2b473b",
                   "7b20331e03018ca74f0212aff3d5a1a66e2375188691df56c9b2b89ba84ad38b",
                   "dc3bcf4dee3b8c3ca0062284f53e5f717085bd3f3ac6b1ac70492425a7cf2474",
                   "81fac89743d43b741a009541a9c365ed3213f49cf6314d9c50418ab0d9e82528",
                   "7d2c761823b183cd34a8c1c0b7b6f572d26a0265bfe65afe913faf60d27de844",
                   "f943329f6399ecd418268484bc61d98887b7fc8454c2409a79adc3b965ae75a0",
                   "ae27abffcc06755840792abb83a67b847782afa01bb26c2631671ed3932930b6",
                   "6af431b97e8571a2c072a746a44b5e0dcb3685268f75459e789063e03b7698cb",
                   "b31ed4807259472689f984e348f10e15125fae9df1298e6befddd5411a2a7dda",
                   "d0916c34fb5a3580baf74f401277ceb480eec5b4e0a61aea3400f2491922019a") and
    not (process.name : "powershell.exe" and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
    not (process.name : "powershell.exe" and
         process.parent.executable : ("C:\\WINDOWS\\_ScriptingFramework\\Modul\\Engine.exe",
                                      "C:\\Windows\\System32\\gpscript.exe",
                                      "C:\\Windows\\IMECache\\*\\RjImeHost.exe")) and
    process.pe.original_file_name != "Adobe Installer" and
    not process.parent.executable :
                       ("C:\\Windows\\highsystem.NET\\Client\\hdnClSvc.NET.exe",
                        "C:\\Program Files (x86)\\AOMEI\\AOMEI Backupper\\*\\unins*.exe",
                        "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcconfigexec.exe",
                        "C:\\Windows\\highsystem.NET\\Client\\hdnClSvc.NET.exe",
                        "C:\\Program Files (x86)\\AOMEI\\AOMEI Backupper\\*\\unins*.exe",
                        "C:\\Program Files (x86)\\Common Files\\InstallShield\\*.exe",
                        "C:\\Program Files\\RepairTech\\Syncro\\Syncro.App.Runner.exe",
                        "C:\\Program Files (x86)\\*\\unins*.exe") and
    not (process.name : "powershell.exe" and process.args : "RemoteSigned") and
    not (process.name : "cscript.exe" and process.parent.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", "C:\\Users\\*\\AppData\\Local\\Temp\\is-*.tmp\\*.tmp")) and
    not (process.name : "powershell.exe" and process.parent.code_signature.subject_name in ("Patch My PC, LLC", "Grammarly, Inc.", "FastTrack Software ApS") and process.parent.code_signature.trusted == true)
   ] by process.entity_id
   [file where event.action : "creation" and process.name : "svchost.exe" and
    file.path : ("?:\\Windows\\Tasks\\*", "?:\\Windows\\System32\\Tasks\\*") and

    /* excluding via Powershell cmdline is also vulnerable to evasion */
    not (Effective_process.name : "powershell.exe" and
          file.path :
             ("?:\\WINDOWS\\System32\\Tasks\\PSWindowsUpdate",
              "?:\\Windows\\System32\\Tasks\\npcapwatchdog",
              "?:\\Windows\\System32\\Tasks\\ChocoUpgrade",
              "?:\\Windows\\System32\\Tasks\\ansible-ansible.windows.win_updates",
              "?:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\PowerShell\\ScheduledJobs\\ansible-win-updates",
              "?:\\WINDOWS\\System32\\Tasks\\PRISM Monitoring - System Data",
              "?:\\Windows\\System32\\Tasks\\PRISM Cloud Monitoring - System Data")) and

    not (file.name : "Microsoft Office 1? Sync Maintenance for *" and file.size >= 5200 and file.size <= 5300 and
         Effective_process.name : ("winword.exe", "excel.exe", "powerpnt.exe")) and
    not (file.name : "OneDrive Standalone Update Task-S-1-5-21-*" and Effective_process.executable : "\\Device\\Mup\\*") and
    not (file.path :  "C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*" and Effective_process.executable : "C:\\Windows\\System32\\xwizard.exe") and
    not (file.name like ("TSS-Framework_wsusutil", "PSAppDeployToolkit_MicrosoftCorporation_*") and Effective_process.name : "powershell.exe")
    ] by Effective_process.entity_id
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.005"
name = "Scheduled Task"
reference = "https://attack.mitre.org/techniques/T1053/005/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.8.0"

Stages and Predicates

Ordered sequence: each step below must occur in order within 5m, correlated by Effective_process.entity_id, process.entity_id.

Stage 1: process

[process where event.action == "start" and
    (
     process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
                     "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe","RegSvcs.exe",
                     "msxsl.exe", "xwizard.exe", "csc.exe", "winword.exe", "excel.exe", "powerpnt.exe",
                     "powershell.exe")  or
     (process.name : "javaw.exe" and process.args : "-jar" and process.args_count == 3 and
      process.args : ("?:\\Users\\*", "?:\\ProgramData\\*")) or
    ((process.code_signature.trusted == false or process.code_signature.exists == false) and
      (process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and
      not process.code_signature.status : ("errorTimeStamp", "errorCode_endpoint*", "errorExpired", "errorChaining")) or
    (process.executable :
         ("?:\\Users\\Public\\*",
          "?:\\Users\\*\\AppData\\Roaming\\*",
          "?:\\ProgramData\\*",
          "?:\\Windows\\Microsoft.NET\\*",
          "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
          "?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
          "?:\\Users\\*\\AppData\\Local\\Temp\\Rar*",
          "?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*",
          "\\Device\\CdRom*") and not process.code_signature.trusted == true) or
    (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*")
    ) and
    not (process.name : "rundll32.exe" and process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and process.parent.name : "msiexec.exe") and
    not (process.name : ("rundll32.exe", "regsvr32.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
    not (process.code_signature.trusted == true and process.executable : ("?:\\Users\\*\\AppData\\Roaming\\*", "?:\\ProgramData\\*")) and
    not (process.name : "rundll32.exe" and process.args : "tsworkspace,TaskUpdateWorkspaces") and
    not (process.name : "rundll32.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and process.command_line : "*pcrpf.dll,NotifyFirmwareUpdateStaged*") and
    not (process.executable : "\\Device\\Mup\\*\\OneDriveSetup.exe" and process.args : "/ALLUSERS") and
    not (process.name : "rundll32.exe" and
         process.command_line : ("*PWMTR32V.dll,InitializeSettingsDuringInstallation*", "*RunDll_EnableBits*")) and
    not (process.name : "powershell.exe" and
         process.command_line :
                   ("*:\\Program Files\\*", "*:\\Program Files (X86)\\*",
                    "*Packages\\Plugins\\Microsoft.AdminCenter.AdminCenter*",
                    "*:\\WINDOWS\\ccmcache\\*",
                    "*EEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBGADgAQQBjAHcA*",
                    "*UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAA*",
                    "*-EncodedCommand*",
                    "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ")) and
    not (process.name : "powershell.exe" and
         process.parent.executable : ("?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
                                      "?:\\Program Files (x86)\\Spiceworks Agent Shell\\AgentShellService.exe",
                                      "?:\\Program Files (x86)\\ITSPlatform\\plugin\\scripting\\platform-scripting-plugin.exe",
                                      "?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
                                      "?:\\Program Files (x86)\\Lenovo\\VantageService\\*\\Lenovo.Vantage.AddinInstaller.exe",
                                      "?:\\ProgramData\\Lenovo\\LenovoNow\\Downloads\\LenovoNow.Updater.exe",
                                      "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoFirstRunExperiencePackage\\x86\\LenovoWelcomeTask.exe",
                                      "?:\\Program Files (x86)\\Microsoft Intune Management Extension\\agentexecutor.exe",
                                      "C:\\Banyan\\Canopy\\Leaf\\leaf_desktop_app.exe",
                                      "?:\\windows\\system32\\msiexec.exe",
                                      "?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
                                      "C:\\Windows\\CCM\\OSDRunPowerShellScript.exe",
                                      "C:\\Windows\\System32\\runonce.exe")) and
    not (process.name : "powershell.exe" and user.id : "S-1-5-18") and
    not (process.name : "powershell.exe" and process.parent.name : "powershell.exe" and process.parent.args : "-EncodedCommand" and process.parent.args : "cABvAHcAZQByAHMAaABlAGw*") and
    not (process.name : "powershell.exe" and process.args : ("-nomeAgente", "\\\\*\\*.ps1", "& 'C:\\oracle_unified_agent\\scripts\\unified-agent-permissions.ps1' ; exit $($LASTEXITCODE)")) and
    not (process.parent.name : "rundll32.exe" and process.parent.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*") and
    not (process.name : "rundll32.exe" and process.command_line : ("*zzzzInvokeManagedCustomActionOutOfProc*", "*tsworkspace,WorkspaceSilentSetup*")) and
    not process.executable :
                ("?:\\Program Files (x86)\\*.exe",
                 "?:\\Program Files\\*.exe",
                 "?:\\Windows\\SysWOW64\\OneDriveSetup.exe",
                 "?:\\Windows\\System32\\MRT.exe",
                 "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe",
                 "C:\\Windows\\SystemTemp\\SupportAssistAgent\\*\\SupportAssistDeployment.exe") and
    not (process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and not process.working_directory : "C:\\*") and
    not process.hash.sha256 :
                  ("3d95157908cee58d19193c93c5f2b0a06910b8123a4211b0ea059ff66f2506e0",
                   "79dbc3cf0d4cdc0f2150ab5e2bf3457ba54297202500f26f1a1d48e455f7c54a",
                   "62d96982e2c2d58682471af9a9d0727ba49199d48b7766c318886e8e7e23670a",
                   "ef330f95416162866f5d8b9cd509066ab4168cfcc66e305006be1952905d47e6",
                   "cf635f97d0a3bea30f348277777f36db6b14aea0e7711471e5fb2e13167b80cd",
                   "3c1169568774b7ce8a96e137983b059f030eb3983c369cfb12ea2c59cf3f56ad",
                   "edaf602006b53dc936a35d0f9e6de51c552c0203ebe814cb68b1d5cbc81f4b49",
                   "82c97648fa358c31fb47e44762938738ad3080880b84b69d9c303d708ab160c2",
                   "4aff93803f1915f3a10f19a1d1e065483c4d11221e3c2792b3de1807c7bf1d9a",
                   "f9e86b3a6275429f5dbecccc2020e498032a96fc02dd8bdb2a1cc5b5bf2b473b",
                   "7b20331e03018ca74f0212aff3d5a1a66e2375188691df56c9b2b89ba84ad38b",
                   "dc3bcf4dee3b8c3ca0062284f53e5f717085bd3f3ac6b1ac70492425a7cf2474",
                   "81fac89743d43b741a009541a9c365ed3213f49cf6314d9c50418ab0d9e82528",
                   "7d2c761823b183cd34a8c1c0b7b6f572d26a0265bfe65afe913faf60d27de844",
                   "f943329f6399ecd418268484bc61d98887b7fc8454c2409a79adc3b965ae75a0",
                   "ae27abffcc06755840792abb83a67b847782afa01bb26c2631671ed3932930b6",
                   "6af431b97e8571a2c072a746a44b5e0dcb3685268f75459e789063e03b7698cb",
                   "b31ed4807259472689f984e348f10e15125fae9df1298e6befddd5411a2a7dda",
                   "d0916c34fb5a3580baf74f401277ceb480eec5b4e0a61aea3400f2491922019a") and
    not (process.name : "powershell.exe" and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
    not (process.name : "powershell.exe" and
         process.parent.executable : ("C:\\WINDOWS\\_ScriptingFramework\\Modul\\Engine.exe",
                                      "C:\\Windows\\System32\\gpscript.exe",
                                      "C:\\Windows\\IMECache\\*\\RjImeHost.exe")) and
    process.pe.original_file_name != "Adobe Installer" and
    not process.parent.executable :
                       ("C:\\Windows\\highsystem.NET\\Client\\hdnClSvc.NET.exe",
                        "C:\\Program Files (x86)\\AOMEI\\AOMEI Backupper\\*\\unins*.exe",
                        "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcconfigexec.exe",
                        "C:\\Windows\\highsystem.NET\\Client\\hdnClSvc.NET.exe",
                        "C:\\Program Files (x86)\\AOMEI\\AOMEI Backupper\\*\\unins*.exe",
                        "C:\\Program Files (x86)\\Common Files\\InstallShield\\*.exe",
                        "C:\\Program Files\\RepairTech\\Syncro\\Syncro.App.Runner.exe",
                        "C:\\Program Files (x86)\\*\\unins*.exe") and
    not (process.name : "powershell.exe" and process.args : "RemoteSigned") and
    not (process.name : "cscript.exe" and process.parent.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", "C:\\Users\\*\\AppData\\Local\\Temp\\is-*.tmp\\*.tmp")) and
    not (process.name : "powershell.exe" and process.parent.code_signature.subject_name in ("Patch My PC, LLC", "Grammarly, Inc.", "FastTrack Software ApS") and process.parent.code_signature.trusted == true)
   ] by process.entity_id

Stage 2: file

[file where event.action : "creation" and process.name : "svchost.exe" and
    file.path : ("?:\\Windows\\Tasks\\*", "?:\\Windows\\System32\\Tasks\\*") and
    not (Effective_process.name : "powershell.exe" and
          file.path :
             ("?:\\WINDOWS\\System32\\Tasks\\PSWindowsUpdate",
              "?:\\Windows\\System32\\Tasks\\npcapwatchdog",
              "?:\\Windows\\System32\\Tasks\\ChocoUpgrade",
              "?:\\Windows\\System32\\Tasks\\ansible-ansible.windows.win_updates",
              "?:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\PowerShell\\ScheduledJobs\\ansible-win-updates",
              "?:\\WINDOWS\\System32\\Tasks\\PRISM Monitoring - System Data",
              "?:\\Windows\\System32\\Tasks\\PRISM Cloud Monitoring - System Data")) and
    not (file.name : "Microsoft Office 1? Sync Maintenance for *" and file.size >= 5200 and file.size <= 5300 and
         Effective_process.name : ("winword.exe", "excel.exe", "powerpnt.exe")) and
    not (file.name : "OneDrive Standalone Update Task-S-1-5-21-*" and Effective_process.executable : "\\Device\\Mup\\*") and
    not (file.path :  "C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*" and Effective_process.executable : "C:\\Windows\\System32\\xwizard.exe") and
    not (file.name like ("TSS-Framework_wsusutil", "PSAppDeployToolkit_MicrosoftCorporation_*") and Effective_process.name : "powershell.exe")
    ] by Effective_process.entity_id

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
process.working_directorystarts_withC:\excludes:process.working_directory field:"process.working_directory" value:"C:\"
process.nameeqwinword.exe, excel.exe, powerpnt.exeexcludes:process.name field:"process.name" value:"winword.exe" field:"process.name" value:"excel.exe" field:"process.name" value:"powerpnt.exe"
process.argseq/ALLUSERSexcludes:process.args field:"process.args" value:"/ALLUSERS"
process.executablewildcard\Device\Mup\*\OneDriveSetup.exeexcludes:process.executable field:"process.executable" value:"\Device\Mup\*\OneDriveSetup.exe"
process.argseqRemoteSignedexcludes:process.args field:"process.args" value:"RemoteSigned"
process.nameeqpowershell.exeexcludes:process.name field:"process.name" value:"powershell.exe"
process.argseqtsworkspace,TaskUpdateWorkspacesexcludes:process.args field:"process.args" value:"tsworkspace,TaskUpdateWorkspaces"
process.nameeqrundll32.exeexcludes:process.name field:"process.name" value:"rundll32.exe"
process.argsstarts_with?:\Program Files\, ?:\Program Files (x86)\excludes:process.args field:"process.args" value:"?:\Program Files\" field:"process.args" value:"?:\Program Files (x86)\"
process.nameeqrundll32.exe, regsvr32.exeexcludes:process.name field:"process.name" value:"rundll32.exe" field:"process.name" value:"regsvr32.exe"
process.argswildcard-nomeAgente, \\*\*.ps1, & 'C:\oracle_unified_agent\scripts\unified-agent-permissions.ps1' ; exit $($LASTEXITCODE)excludes:process.args field:"process.args" value:"-nomeAgente" field:"process.args" value:"\\*\*.ps1" field:"process.args" value:"& 'C:\oracle_unified_agent\scripts\unified-agent-permissions.ps1' ; exit $($LASTEXITCODE)"
process.code_signature.trustedeqtrueexcludes:process.code_signature.trusted field:"process.code_signature.trusted" value:"true"
process.executablewildcard?:\Users\*\AppData\Roaming\*, ?:\ProgramData\*excludes:process.executable field:"process.executable" value:"?:\Users\*\AppData\Roaming\*" field:"process.executable" value:"?:\ProgramData\*"
process.command_linematchPWMTR32V.dll,InitializeSettingsDuringInstallation, RunDll_EnableBitsexcludes:process.command_line field:"process.command_line" value:"PWMTR32V.dll,InitializeSettingsDuringInstallation" field:"process.command_line" value:"RunDll_EnableBits"
process.command_linematchpcrpf.dll,NotifyFirmwareUpdateStagedexcludes:process.command_line field:"process.command_line" value:"pcrpf.dll,NotifyFirmwareUpdateStaged"
process.parent.executableeq?:\Windows\System32\svchost.exeexcludes:process.parent.executable field:"process.parent.executable" value:"?:\Windows\System32\svchost.exe"
process.command_linematchzzzzInvokeManagedCustomActionOutOfProc, tsworkspace,WorkspaceSilentSetupexcludes:process.command_line field:"process.command_line" value:"zzzzInvokeManagedCustomActionOutOfProc" field:"process.command_line" value:"tsworkspace,WorkspaceSilentSetup"
process.command_linematchzzzzInvokeManagedCustomActionOutOfProcexcludes:process.command_line field:"process.command_line" value:"zzzzInvokeManagedCustomActionOutOfProc"
process.parent.nameeqmsiexec.exeexcludes:process.parent.name field:"process.parent.name" value:"msiexec.exe"
process.command_linewildcard*:\Program Files\*, *:\Program Files (X86)\*, *Packages\Plugins\Microsoft.AdminCenter.AdminCenter*, *:\WINDOWS\ccmcache\*, *EEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBGADgAQQBjAHcA*, *UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAA*, *-EncodedCommand*, "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" excludes:process.command_line
process.nameeqcscript.exeexcludes:process.name field:"process.name" value:"cscript.exe"
process.parent.executablewildcard?:\Program Files (x86)\*, ?:\Program Files\*, C:\Users\*\AppData\Local\Temp\is-*.tmp\*.tmpexcludes:process.parent.executable field:"process.parent.executable" value:"?:\Program Files (x86)\*" field:"process.parent.executable" value:"?:\Program Files\*" field:"process.parent.executable" value:"C:\Users\*\AppData\Local\Temp\is-*.tmp\*.tmp"
process.parent.argseq-EncodedCommandexcludes:process.parent.args field:"process.parent.args" value:"-EncodedCommand"
process.parent.argsstarts_withcABvAHcAZQByAHMAaABlAGwexcludes:process.parent.args field:"process.parent.args" value:"cABvAHcAZQByAHMAaABlAGw"
process.parent.nameeqpowershell.exeexcludes:process.parent.name field:"process.parent.name" value:"powershell.exe"
process.parent.code_signature.subject_nameinFastTrack Software ApS, Grammarly, Inc., Patch My PC, LLCexcludes:process.parent.code_signature.subject_name field:"process.parent.code_signature.subject_name" value:"FastTrack Software ApS" field:"process.parent.code_signature.subject_name" value:"Grammarly, Inc." field:"process.parent.code_signature.subject_name" value:"Patch My PC, LLC"
process.parent.code_signature.trustedeqtrueexcludes:process.parent.code_signature.trusted field:"process.parent.code_signature.trusted" value:"true"
process.parent.executablewildcard?:\Program Files (x86)\Microsoft Intune Management Extension\AgentExecutor.exe, ?:\Program Files (x86)\Spiceworks Agent Shell\AgentShellService.exe, ?:\Program Files (x86)\ITSPlatform\plugin\scripting\platform-scripting-plugin.exe, ?:\Program Files (x86)\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe, ?:\Program Files (x86)\Lenovo\VantageService\*\Lenovo.Vantage.AddinInstaller.exe, ?:\ProgramData\Lenovo\LenovoNow\Downloads\LenovoNow.Updater.exe, ?:\ProgramData\Lenovo\ImController\Plugins\LenovoFirstRunExperiencePackage\x86\LenovoWelcomeTask.exe, ?:\Program Files (x86)\Microsoft Intune Management Extension\agentexecutor.exe, C:\Banyan\Canopy\Leaf\leaf_desktop_app.exe, ?:\windows\system32\msiexec.exe, ?:\Program Files (x86)\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe, C:\Windows\CCM\OSDRunPowerShellScript.exe, C:\Windows\System32\runonce.exeexcludes:process.parent.executable
process.parent.executablewildcardC:\WINDOWS\_ScriptingFramework\Modul\Engine.exe, C:\Windows\System32\gpscript.exe, C:\Windows\IMECache\*\RjImeHost.exeexcludes:process.parent.executable field:"process.parent.executable" value:"C:\WINDOWS\_ScriptingFramework\Modul\Engine.exe" field:"process.parent.executable" value:"C:\Windows\System32\gpscript.exe" field:"process.parent.executable" value:"C:\Windows\IMECache\*\RjImeHost.exe"
user.ideqS-1-5-18excludes:user.id field:"user.id" value:"S-1-5-18"
process.parent.command_linematchzzzzInvokeManagedCustomActionOutOfProcexcludes:process.parent.command_line field:"process.parent.command_line" value:"zzzzInvokeManagedCustomActionOutOfProc"
process.parent.nameeqrundll32.exeexcludes:process.parent.name field:"process.parent.name" value:"rundll32.exe"
process.executablewildcard?:\Program Files (x86)\*.exe, ?:\Program Files\*.exe, ?:\Windows\SysWOW64\OneDriveSetup.exe, ?:\Windows\System32\MRT.exe, ?:\Users\*\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe, C:\Windows\SystemTemp\SupportAssistAgent\*\SupportAssistDeployment.exeexcludes:process.executable
process.hash.sha256eq3d95157908cee58d19193c93c5f2b0a06910b8123a4211b0ea059ff66f2506e0, 79dbc3cf0d4cdc0f2150ab5e2bf3457ba54297202500f26f1a1d48e455f7c54a, 62d96982e2c2d58682471af9a9d0727ba49199d48b7766c318886e8e7e23670a, ef330f95416162866f5d8b9cd509066ab4168cfcc66e305006be1952905d47e6, cf635f97d0a3bea30f348277777f36db6b14aea0e7711471e5fb2e13167b80cd, 3c1169568774b7ce8a96e137983b059f030eb3983c369cfb12ea2c59cf3f56ad, edaf602006b53dc936a35d0f9e6de51c552c0203ebe814cb68b1d5cbc81f4b49, 82c97648fa358c31fb47e44762938738ad3080880b84b69d9c303d708ab160c2, 4aff93803f1915f3a10f19a1d1e065483c4d11221e3c2792b3de1807c7bf1d9a, f9e86b3a6275429f5dbecccc2020e498032a96fc02dd8bdb2a1cc5b5bf2b473b, 7b20331e03018ca74f0212aff3d5a1a66e2375188691df56c9b2b89ba84ad38b, dc3bcf4dee3b8c3ca0062284f53e5f717085bd3f3ac6b1ac70492425a7cf2474, 81fac89743d43b741a009541a9c365ed3213f49cf6314d9c50418ab0d9e82528, 7d2c761823b183cd34a8c1c0b7b6f572d26a0265bfe65afe913faf60d27de844, f943329f6399ecd418268484bc61d98887b7fc8454c2409a79adc3b965ae75a0, ae27abffcc06755840792abb83a67b847782afa01bb26c2631671ed3932930b6, 6af431b97e8571a2c072a746a44b5e0dcb3685268f75459e789063e03b7698cb, b31ed4807259472689f984e348f10e15125fae9df1298e6befddd5411a2a7dda, d0916c34fb5a3580baf74f401277ceb480eec5b4e0a61aea3400f2491922019aexcludes:process.hash.sha256
process.parent.executablewildcardC:\Windows\highsystem.NET\Client\hdnClSvc.NET.exe, C:\Program Files (x86)\AOMEI\AOMEI Backupper\*\unins*.exe, C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcconfigexec.exe, C:\Windows\highsystem.NET\Client\hdnClSvc.NET.exe, C:\Program Files (x86)\AOMEI\AOMEI Backupper\*\unins*.exe, C:\Program Files (x86)\Common Files\InstallShield\*.exe, C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe, C:\Program Files (x86)\*\unins*.exeexcludes:process.parent.executable
Effective_process.executableeqC:\Windows\System32\xwizard.exeexcludes:Effective_process.executable field:"Effective_process.executable" value:"C:\Windows\System32\xwizard.exe"
file.pathstarts_withC:\Windows\System32\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update\excludes:file.path field:"file.path" value:"C:\Windows\System32\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update\"
Effective_process.executablestarts_with\Device\Mup\excludes:Effective_process.executable field:"Effective_process.executable" value:"\Device\Mup\"
file.namestarts_withOneDrive Standalone Update Task-S-1-5-21-excludes:file.name field:"file.name" value:"OneDrive Standalone Update Task-S-1-5-21-"
Effective_process.nameeqpowershell.exeexcludes:Effective_process.name field:"Effective_process.name" value:"powershell.exe"
file.namewildcardTSS-Framework_wsusutil, PSAppDeployToolkit_MicrosoftCorporation_*excludes:file.name field:"file.name" value:"TSS-Framework_wsusutil" field:"file.name" value:"PSAppDeployToolkit_MicrosoftCorporation_*"
file.patheq?:\WINDOWS\System32\Tasks\PSWindowsUpdate, ?:\Windows\System32\Tasks\npcapwatchdog, ?:\Windows\System32\Tasks\ChocoUpgrade, ?:\Windows\System32\Tasks\ansible-ansible.windows.win_updates, ?:\Windows\System32\Tasks\Microsoft\Windows\PowerShell\ScheduledJobs\ansible-win-updates, ?:\WINDOWS\System32\Tasks\PRISM Monitoring - System Data, ?:\Windows\System32\Tasks\PRISM Cloud Monitoring - System Dataexcludes:file.path
Effective_process.nameeqwinword.exe, excel.exe, powerpnt.exeexcludes:Effective_process.name field:"Effective_process.name" value:"winword.exe" field:"Effective_process.name" value:"excel.exe" field:"Effective_process.name" value:"powerpnt.exe"
file.namestarts_withMicrosoft Office 1? Sync Maintenance for excludes:file.name field:"file.name" value:"Microsoft Office 1? Sync Maintenance for "
file.sizege5200excludes:file.size field:"file.size" value:"5200"
file.sizele5300excludes:file.size field:"file.size" value:"5300"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
event.actioneq
  • start corpus 391 (elastic 391)
field:"EventType" kind:eq value:"start"
event.actionwildcard
  • creation corpus 58 (elastic 58)
field:"EventType" kind:wildcard value:"creation"
file.pathwildcard
  • ?:\Windows\System32\Tasks\* corpus 6 (elastic 6)
  • ?:\Windows\Tasks\* corpus 7 (elastic 7)
field:"TargetFilename" kind:wildcard
process.Ext.device.product_idwildcard
  • Virtual DVD-ROM corpus 13 (elastic 13)
  • Virtual Disk corpus 13 (elastic 13)
field:"process.Ext.device.product_id" kind:wildcard
process.Ext.relative_file_creation_timele
  • 300 transforms: number corpus 11 (elastic 11)
field:"process.Ext.relative_file_creation_time" kind:le value:"300"
process.Ext.relative_file_name_modify_timele
  • 300 transforms: number corpus 9 (elastic 9)
field:"process.Ext.relative_file_name_modify_time" kind:le value:"300"
process.argswildcard
  • -jar corpus 8 (elastic 8)
  • ?:\ProgramData\* corpus 3 (elastic 3)
  • ?:\Users\* corpus 4 (elastic 4)
field:"process.args" kind:wildcard
process.args_counteq
  • 3 transforms: number corpus 22 (elastic 22)
field:"process.args_count" kind:eq value:"3"
process.code_signature.existseq
  • false transforms: boolean corpus 119 (elastic 119)
field:"process.code_signature.exists" kind:eq value:"false"
process.code_signature.trustedeq
  • false transforms: boolean corpus 115 (elastic 115)
field:"process.code_signature.trusted" kind:eq value:"false"
process.executablewildcard
  • ?:\ProgramData\* corpus 17 (elastic 17)
  • ?:\Users\*\AppData\Local\Temp\7z* corpus 4 (elastic 4)
  • ?:\Users\*\AppData\Local\Temp\BNZ.* corpus 7 (elastic 7)
  • ?:\Users\*\AppData\Local\Temp\Rar* corpus 3 (elastic 3)
  • ?:\Users\*\AppData\Local\Temp\Temp?_* corpus 4 (elastic 4)
  • ?:\Users\*\AppData\Roaming\* corpus 5 (elastic 5)
  • ?:\Users\Public\* corpus 4 (elastic 4)
  • ?:\Windows\Microsoft.NET\* corpus 5 (elastic 5)
  • \Device\CdRom* corpus 2 (elastic 2)
field:"Image" kind:wildcard
process.namewildcard
  • RegAsm.exe corpus 26 (elastic 24, splunk 2)
  • RegSvcs.exe corpus 23 (elastic 21, splunk 2)
  • cmstp.exe corpus 25 (elastic 25)
  • csc.exe corpus 12 (elastic 11, splunk 1)
  • cscript.exe corpus 67 (elastic 65, splunk 2)
  • excel.exe corpus 34 (elastic 34)
  • installutil.exe corpus 37 (elastic 32, splunk 5)
  • javaw.exe corpus 9 (elastic 9)
  • msbuild.exe corpus 39 (elastic 36, splunk 3)
  • mshta.exe corpus 84 (elastic 79, splunk 5)
  • msxsl.exe corpus 23 (elastic 22, splunk 1)
  • powerpnt.exe corpus 31 (elastic 31)
  • powershell.exe corpus 184 (elastic 140, splunk 44)
  • regsvr32.exe corpus 73 (elastic 68, splunk 5)
  • rundll32.exe corpus 126 (elastic 100, splunk 26)
  • svchost.exe corpus 24 (elastic 22, splunk 2)
  • vbc.exe corpus 9 (elastic 8, splunk 1)
  • winword.exe corpus 35 (elastic 35)
  • wmic.exe corpus 66 (elastic 39, splunk 27)
  • wscript.exe corpus 83 (elastic 82, splunk 1)
  • xwizard.exe corpus 16 (elastic 16)
field:"process_name" kind:wildcard
process.pe.original_file_namene
  • Adobe Installer
field:"OriginalFileName" kind:ne value:"Adobe Installer"
process.working_directorywildcard
  • C:\*
field:"CurrentDirectory" kind:wildcard value:"C:\*"