Detection rules › Elastic
Scheduled Task Creation by an Unusual Process
Identifies the creation of a scheduled task by an unusual process such as script interpreters or recently dropped unsigned executables. This behavior is consistent with an adversary attempting to establish persistence.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence |
Rule body
[rule]
description = """
Identifies the creation of a scheduled task by an unusual process such as script interpreters or recently dropped
unsigned executables. This behavior is consistent with an adversary attempting to establish persistence.
"""
id = "cb5fdbe3-84fa-4277-a967-1ffc0e8d3d25"
license = "Elastic License v2"
name = "Scheduled Task Creation by an Unusual Process"
os_list = ["windows"]
reference = [
"https://docs.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-",
"https://www.elastic.co/security-labs/dipping-into-danger",
"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
]
version = "1.0.44"
query = '''
sequence with maxspan=5m
[process where event.action == "start" and
(
/* common initial access processes */
process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
"msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe","RegSvcs.exe",
"msxsl.exe", "xwizard.exe", "csc.exe", "winword.exe", "excel.exe", "powerpnt.exe",
"powershell.exe") or
(process.name : "javaw.exe" and process.args : "-jar" and process.args_count == 3 and
process.args : ("?:\\Users\\*", "?:\\ProgramData\\*")) or
/* unsigned or untrusted codesign */
((process.code_signature.trusted == false or process.code_signature.exists == false) and
(process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and
not process.code_signature.status : ("errorTimeStamp", "errorCode_endpoint*", "errorExpired", "errorChaining")) or
/* common abused paths */
(process.executable :
("?:\\Users\\Public\\*",
"?:\\Users\\*\\AppData\\Roaming\\*",
"?:\\ProgramData\\*",
"?:\\Windows\\Microsoft.NET\\*",
"?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
"?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
"?:\\Users\\*\\AppData\\Local\\Temp\\Rar*",
"?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*",
"\\Device\\CdRom*") and not process.code_signature.trusted == true) or
/* execution from a mounted device */
(process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*")
) and
/* known FPs */
not (process.name : "rundll32.exe" and process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and process.parent.name : "msiexec.exe") and
not (process.name : ("rundll32.exe", "regsvr32.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
not (process.code_signature.trusted == true and process.executable : ("?:\\Users\\*\\AppData\\Roaming\\*", "?:\\ProgramData\\*")) and
not (process.name : "rundll32.exe" and process.args : "tsworkspace,TaskUpdateWorkspaces") and
not (process.name : "rundll32.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and process.command_line : "*pcrpf.dll,NotifyFirmwareUpdateStaged*") and
not (process.executable : "\\Device\\Mup\\*\\OneDriveSetup.exe" and process.args : "/ALLUSERS") and
not (process.name : "rundll32.exe" and
process.command_line : ("*PWMTR32V.dll,InitializeSettingsDuringInstallation*", "*RunDll_EnableBits*")) and
not (process.name : "powershell.exe" and
process.command_line :
("*:\\Program Files\\*", "*:\\Program Files (X86)\\*",
"*Packages\\Plugins\\Microsoft.AdminCenter.AdminCenter*",
"*:\\WINDOWS\\ccmcache\\*",
"*EEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBGADgAQQBjAHcA*",
"*UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAA*",
"*-EncodedCommand*",
"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ")) and
not (process.name : "powershell.exe" and
process.parent.executable : ("?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
"?:\\Program Files (x86)\\Spiceworks Agent Shell\\AgentShellService.exe",
"?:\\Program Files (x86)\\ITSPlatform\\plugin\\scripting\\platform-scripting-plugin.exe",
"?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
"?:\\Program Files (x86)\\Lenovo\\VantageService\\*\\Lenovo.Vantage.AddinInstaller.exe",
"?:\\ProgramData\\Lenovo\\LenovoNow\\Downloads\\LenovoNow.Updater.exe",
"?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoFirstRunExperiencePackage\\x86\\LenovoWelcomeTask.exe",
"?:\\Program Files (x86)\\Microsoft Intune Management Extension\\agentexecutor.exe",
"C:\\Banyan\\Canopy\\Leaf\\leaf_desktop_app.exe",
"?:\\windows\\system32\\msiexec.exe",
"?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
"C:\\Windows\\CCM\\OSDRunPowerShellScript.exe",
"C:\\Windows\\System32\\runonce.exe")) and
not (process.name : "powershell.exe" and user.id : "S-1-5-18") and
not (process.name : "powershell.exe" and process.parent.name : "powershell.exe" and process.parent.args : "-EncodedCommand" and process.parent.args : "cABvAHcAZQByAHMAaABlAGw*") and
not (process.name : "powershell.exe" and process.args : ("-nomeAgente", "\\\\*\\*.ps1", "& 'C:\\oracle_unified_agent\\scripts\\unified-agent-permissions.ps1' ; exit $($LASTEXITCODE)")) and
not (process.parent.name : "rundll32.exe" and process.parent.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*") and
not (process.name : "rundll32.exe" and process.command_line : ("*zzzzInvokeManagedCustomActionOutOfProc*", "*tsworkspace,WorkspaceSilentSetup*")) and
not process.executable :
("?:\\Program Files (x86)\\*.exe",
"?:\\Program Files\\*.exe",
"?:\\Windows\\SysWOW64\\OneDriveSetup.exe",
"?:\\Windows\\System32\\MRT.exe",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe",
"C:\\Windows\\SystemTemp\\SupportAssistAgent\\*\\SupportAssistDeployment.exe") and
/* DOCs opened from network file share trigger an office default scheduled task */
not (process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and not process.working_directory : "C:\\*") and
not process.hash.sha256 :
("3d95157908cee58d19193c93c5f2b0a06910b8123a4211b0ea059ff66f2506e0",
"79dbc3cf0d4cdc0f2150ab5e2bf3457ba54297202500f26f1a1d48e455f7c54a",
"62d96982e2c2d58682471af9a9d0727ba49199d48b7766c318886e8e7e23670a",
"ef330f95416162866f5d8b9cd509066ab4168cfcc66e305006be1952905d47e6",
"cf635f97d0a3bea30f348277777f36db6b14aea0e7711471e5fb2e13167b80cd",
"3c1169568774b7ce8a96e137983b059f030eb3983c369cfb12ea2c59cf3f56ad",
"edaf602006b53dc936a35d0f9e6de51c552c0203ebe814cb68b1d5cbc81f4b49",
"82c97648fa358c31fb47e44762938738ad3080880b84b69d9c303d708ab160c2",
"4aff93803f1915f3a10f19a1d1e065483c4d11221e3c2792b3de1807c7bf1d9a",
"f9e86b3a6275429f5dbecccc2020e498032a96fc02dd8bdb2a1cc5b5bf2b473b",
"7b20331e03018ca74f0212aff3d5a1a66e2375188691df56c9b2b89ba84ad38b",
"dc3bcf4dee3b8c3ca0062284f53e5f717085bd3f3ac6b1ac70492425a7cf2474",
"81fac89743d43b741a009541a9c365ed3213f49cf6314d9c50418ab0d9e82528",
"7d2c761823b183cd34a8c1c0b7b6f572d26a0265bfe65afe913faf60d27de844",
"f943329f6399ecd418268484bc61d98887b7fc8454c2409a79adc3b965ae75a0",
"ae27abffcc06755840792abb83a67b847782afa01bb26c2631671ed3932930b6",
"6af431b97e8571a2c072a746a44b5e0dcb3685268f75459e789063e03b7698cb",
"b31ed4807259472689f984e348f10e15125fae9df1298e6befddd5411a2a7dda",
"d0916c34fb5a3580baf74f401277ceb480eec5b4e0a61aea3400f2491922019a") and
not (process.name : "powershell.exe" and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
not (process.name : "powershell.exe" and
process.parent.executable : ("C:\\WINDOWS\\_ScriptingFramework\\Modul\\Engine.exe",
"C:\\Windows\\System32\\gpscript.exe",
"C:\\Windows\\IMECache\\*\\RjImeHost.exe")) and
process.pe.original_file_name != "Adobe Installer" and
not process.parent.executable :
("C:\\Windows\\highsystem.NET\\Client\\hdnClSvc.NET.exe",
"C:\\Program Files (x86)\\AOMEI\\AOMEI Backupper\\*\\unins*.exe",
"C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcconfigexec.exe",
"C:\\Windows\\highsystem.NET\\Client\\hdnClSvc.NET.exe",
"C:\\Program Files (x86)\\AOMEI\\AOMEI Backupper\\*\\unins*.exe",
"C:\\Program Files (x86)\\Common Files\\InstallShield\\*.exe",
"C:\\Program Files\\RepairTech\\Syncro\\Syncro.App.Runner.exe",
"C:\\Program Files (x86)\\*\\unins*.exe") and
not (process.name : "powershell.exe" and process.args : "RemoteSigned") and
not (process.name : "cscript.exe" and process.parent.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", "C:\\Users\\*\\AppData\\Local\\Temp\\is-*.tmp\\*.tmp")) and
not (process.name : "powershell.exe" and process.parent.code_signature.subject_name in ("Patch My PC, LLC", "Grammarly, Inc.", "FastTrack Software ApS") and process.parent.code_signature.trusted == true)
] by process.entity_id
[file where event.action : "creation" and process.name : "svchost.exe" and
file.path : ("?:\\Windows\\Tasks\\*", "?:\\Windows\\System32\\Tasks\\*") and
/* excluding via Powershell cmdline is also vulnerable to evasion */
not (Effective_process.name : "powershell.exe" and
file.path :
("?:\\WINDOWS\\System32\\Tasks\\PSWindowsUpdate",
"?:\\Windows\\System32\\Tasks\\npcapwatchdog",
"?:\\Windows\\System32\\Tasks\\ChocoUpgrade",
"?:\\Windows\\System32\\Tasks\\ansible-ansible.windows.win_updates",
"?:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\PowerShell\\ScheduledJobs\\ansible-win-updates",
"?:\\WINDOWS\\System32\\Tasks\\PRISM Monitoring - System Data",
"?:\\Windows\\System32\\Tasks\\PRISM Cloud Monitoring - System Data")) and
not (file.name : "Microsoft Office 1? Sync Maintenance for *" and file.size >= 5200 and file.size <= 5300 and
Effective_process.name : ("winword.exe", "excel.exe", "powerpnt.exe")) and
not (file.name : "OneDrive Standalone Update Task-S-1-5-21-*" and Effective_process.executable : "\\Device\\Mup\\*") and
not (file.path : "C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*" and Effective_process.executable : "C:\\Windows\\System32\\xwizard.exe") and
not (file.name like ("TSS-Framework_wsusutil", "PSAppDeployToolkit_MicrosoftCorporation_*") and Effective_process.name : "powershell.exe")
] by Effective_process.entity_id
'''
min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.005"
name = "Scheduled Task"
reference = "https://attack.mitre.org/techniques/T1053/005/"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[internal]
min_endpoint_version = "8.8.0"
Stages and Predicates
Ordered sequence: each step below must occur in order within 5m, correlated by Effective_process.entity_id, process.entity_id.
Stage 1: process
[process where event.action == "start" and
(
process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
"msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe","RegSvcs.exe",
"msxsl.exe", "xwizard.exe", "csc.exe", "winword.exe", "excel.exe", "powerpnt.exe",
"powershell.exe") or
(process.name : "javaw.exe" and process.args : "-jar" and process.args_count == 3 and
process.args : ("?:\\Users\\*", "?:\\ProgramData\\*")) or
((process.code_signature.trusted == false or process.code_signature.exists == false) and
(process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and
not process.code_signature.status : ("errorTimeStamp", "errorCode_endpoint*", "errorExpired", "errorChaining")) or
(process.executable :
("?:\\Users\\Public\\*",
"?:\\Users\\*\\AppData\\Roaming\\*",
"?:\\ProgramData\\*",
"?:\\Windows\\Microsoft.NET\\*",
"?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
"?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
"?:\\Users\\*\\AppData\\Local\\Temp\\Rar*",
"?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*",
"\\Device\\CdRom*") and not process.code_signature.trusted == true) or
(process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*")
) and
not (process.name : "rundll32.exe" and process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and process.parent.name : "msiexec.exe") and
not (process.name : ("rundll32.exe", "regsvr32.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
not (process.code_signature.trusted == true and process.executable : ("?:\\Users\\*\\AppData\\Roaming\\*", "?:\\ProgramData\\*")) and
not (process.name : "rundll32.exe" and process.args : "tsworkspace,TaskUpdateWorkspaces") and
not (process.name : "rundll32.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and process.command_line : "*pcrpf.dll,NotifyFirmwareUpdateStaged*") and
not (process.executable : "\\Device\\Mup\\*\\OneDriveSetup.exe" and process.args : "/ALLUSERS") and
not (process.name : "rundll32.exe" and
process.command_line : ("*PWMTR32V.dll,InitializeSettingsDuringInstallation*", "*RunDll_EnableBits*")) and
not (process.name : "powershell.exe" and
process.command_line :
("*:\\Program Files\\*", "*:\\Program Files (X86)\\*",
"*Packages\\Plugins\\Microsoft.AdminCenter.AdminCenter*",
"*:\\WINDOWS\\ccmcache\\*",
"*EEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBGADgAQQBjAHcA*",
"*UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAA*",
"*-EncodedCommand*",
"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ")) and
not (process.name : "powershell.exe" and
process.parent.executable : ("?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
"?:\\Program Files (x86)\\Spiceworks Agent Shell\\AgentShellService.exe",
"?:\\Program Files (x86)\\ITSPlatform\\plugin\\scripting\\platform-scripting-plugin.exe",
"?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
"?:\\Program Files (x86)\\Lenovo\\VantageService\\*\\Lenovo.Vantage.AddinInstaller.exe",
"?:\\ProgramData\\Lenovo\\LenovoNow\\Downloads\\LenovoNow.Updater.exe",
"?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoFirstRunExperiencePackage\\x86\\LenovoWelcomeTask.exe",
"?:\\Program Files (x86)\\Microsoft Intune Management Extension\\agentexecutor.exe",
"C:\\Banyan\\Canopy\\Leaf\\leaf_desktop_app.exe",
"?:\\windows\\system32\\msiexec.exe",
"?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
"C:\\Windows\\CCM\\OSDRunPowerShellScript.exe",
"C:\\Windows\\System32\\runonce.exe")) and
not (process.name : "powershell.exe" and user.id : "S-1-5-18") and
not (process.name : "powershell.exe" and process.parent.name : "powershell.exe" and process.parent.args : "-EncodedCommand" and process.parent.args : "cABvAHcAZQByAHMAaABlAGw*") and
not (process.name : "powershell.exe" and process.args : ("-nomeAgente", "\\\\*\\*.ps1", "& 'C:\\oracle_unified_agent\\scripts\\unified-agent-permissions.ps1' ; exit $($LASTEXITCODE)")) and
not (process.parent.name : "rundll32.exe" and process.parent.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*") and
not (process.name : "rundll32.exe" and process.command_line : ("*zzzzInvokeManagedCustomActionOutOfProc*", "*tsworkspace,WorkspaceSilentSetup*")) and
not process.executable :
("?:\\Program Files (x86)\\*.exe",
"?:\\Program Files\\*.exe",
"?:\\Windows\\SysWOW64\\OneDriveSetup.exe",
"?:\\Windows\\System32\\MRT.exe",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe",
"C:\\Windows\\SystemTemp\\SupportAssistAgent\\*\\SupportAssistDeployment.exe") and
not (process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and not process.working_directory : "C:\\*") and
not process.hash.sha256 :
("3d95157908cee58d19193c93c5f2b0a06910b8123a4211b0ea059ff66f2506e0",
"79dbc3cf0d4cdc0f2150ab5e2bf3457ba54297202500f26f1a1d48e455f7c54a",
"62d96982e2c2d58682471af9a9d0727ba49199d48b7766c318886e8e7e23670a",
"ef330f95416162866f5d8b9cd509066ab4168cfcc66e305006be1952905d47e6",
"cf635f97d0a3bea30f348277777f36db6b14aea0e7711471e5fb2e13167b80cd",
"3c1169568774b7ce8a96e137983b059f030eb3983c369cfb12ea2c59cf3f56ad",
"edaf602006b53dc936a35d0f9e6de51c552c0203ebe814cb68b1d5cbc81f4b49",
"82c97648fa358c31fb47e44762938738ad3080880b84b69d9c303d708ab160c2",
"4aff93803f1915f3a10f19a1d1e065483c4d11221e3c2792b3de1807c7bf1d9a",
"f9e86b3a6275429f5dbecccc2020e498032a96fc02dd8bdb2a1cc5b5bf2b473b",
"7b20331e03018ca74f0212aff3d5a1a66e2375188691df56c9b2b89ba84ad38b",
"dc3bcf4dee3b8c3ca0062284f53e5f717085bd3f3ac6b1ac70492425a7cf2474",
"81fac89743d43b741a009541a9c365ed3213f49cf6314d9c50418ab0d9e82528",
"7d2c761823b183cd34a8c1c0b7b6f572d26a0265bfe65afe913faf60d27de844",
"f943329f6399ecd418268484bc61d98887b7fc8454c2409a79adc3b965ae75a0",
"ae27abffcc06755840792abb83a67b847782afa01bb26c2631671ed3932930b6",
"6af431b97e8571a2c072a746a44b5e0dcb3685268f75459e789063e03b7698cb",
"b31ed4807259472689f984e348f10e15125fae9df1298e6befddd5411a2a7dda",
"d0916c34fb5a3580baf74f401277ceb480eec5b4e0a61aea3400f2491922019a") and
not (process.name : "powershell.exe" and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
not (process.name : "powershell.exe" and
process.parent.executable : ("C:\\WINDOWS\\_ScriptingFramework\\Modul\\Engine.exe",
"C:\\Windows\\System32\\gpscript.exe",
"C:\\Windows\\IMECache\\*\\RjImeHost.exe")) and
process.pe.original_file_name != "Adobe Installer" and
not process.parent.executable :
("C:\\Windows\\highsystem.NET\\Client\\hdnClSvc.NET.exe",
"C:\\Program Files (x86)\\AOMEI\\AOMEI Backupper\\*\\unins*.exe",
"C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcconfigexec.exe",
"C:\\Windows\\highsystem.NET\\Client\\hdnClSvc.NET.exe",
"C:\\Program Files (x86)\\AOMEI\\AOMEI Backupper\\*\\unins*.exe",
"C:\\Program Files (x86)\\Common Files\\InstallShield\\*.exe",
"C:\\Program Files\\RepairTech\\Syncro\\Syncro.App.Runner.exe",
"C:\\Program Files (x86)\\*\\unins*.exe") and
not (process.name : "powershell.exe" and process.args : "RemoteSigned") and
not (process.name : "cscript.exe" and process.parent.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", "C:\\Users\\*\\AppData\\Local\\Temp\\is-*.tmp\\*.tmp")) and
not (process.name : "powershell.exe" and process.parent.code_signature.subject_name in ("Patch My PC, LLC", "Grammarly, Inc.", "FastTrack Software ApS") and process.parent.code_signature.trusted == true)
] by process.entity_id
Stage 2: file
[file where event.action : "creation" and process.name : "svchost.exe" and
file.path : ("?:\\Windows\\Tasks\\*", "?:\\Windows\\System32\\Tasks\\*") and
not (Effective_process.name : "powershell.exe" and
file.path :
("?:\\WINDOWS\\System32\\Tasks\\PSWindowsUpdate",
"?:\\Windows\\System32\\Tasks\\npcapwatchdog",
"?:\\Windows\\System32\\Tasks\\ChocoUpgrade",
"?:\\Windows\\System32\\Tasks\\ansible-ansible.windows.win_updates",
"?:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\PowerShell\\ScheduledJobs\\ansible-win-updates",
"?:\\WINDOWS\\System32\\Tasks\\PRISM Monitoring - System Data",
"?:\\Windows\\System32\\Tasks\\PRISM Cloud Monitoring - System Data")) and
not (file.name : "Microsoft Office 1? Sync Maintenance for *" and file.size >= 5200 and file.size <= 5300 and
Effective_process.name : ("winword.exe", "excel.exe", "powerpnt.exe")) and
not (file.name : "OneDrive Standalone Update Task-S-1-5-21-*" and Effective_process.executable : "\\Device\\Mup\\*") and
not (file.path : "C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*" and Effective_process.executable : "C:\\Windows\\System32\\xwizard.exe") and
not (file.name like ("TSS-Framework_wsusutil", "PSAppDeployToolkit_MicrosoftCorporation_*") and Effective_process.name : "powershell.exe")
] by Effective_process.entity_id
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
process.working_directory | starts_with | C:\ | excludes:process.working_directory field:"process.working_directory" value:"C:\" |
process.name | eq | winword.exe, excel.exe, powerpnt.exe | excludes:process.name field:"process.name" value:"winword.exe" field:"process.name" value:"excel.exe" field:"process.name" value:"powerpnt.exe" |
process.args | eq | /ALLUSERS | excludes:process.args field:"process.args" value:"/ALLUSERS" |
process.executable | wildcard | \Device\Mup\*\OneDriveSetup.exe | excludes:process.executable field:"process.executable" value:"\Device\Mup\*\OneDriveSetup.exe" |
process.args | eq | RemoteSigned | excludes:process.args field:"process.args" value:"RemoteSigned" |
process.name | eq | powershell.exe | excludes:process.name field:"process.name" value:"powershell.exe" |
process.args | eq | tsworkspace,TaskUpdateWorkspaces | excludes:process.args field:"process.args" value:"tsworkspace,TaskUpdateWorkspaces" |
process.name | eq | rundll32.exe | excludes:process.name field:"process.name" value:"rundll32.exe" |
process.args | starts_with | ?:\Program Files\, ?:\Program Files (x86)\ | excludes:process.args field:"process.args" value:"?:\Program Files\" field:"process.args" value:"?:\Program Files (x86)\" |
process.name | eq | rundll32.exe, regsvr32.exe | excludes:process.name field:"process.name" value:"rundll32.exe" field:"process.name" value:"regsvr32.exe" |
process.args | wildcard | -nomeAgente, \\*\*.ps1, & 'C:\oracle_unified_agent\scripts\unified-agent-permissions.ps1' ; exit $($LASTEXITCODE) | excludes:process.args field:"process.args" value:"-nomeAgente" field:"process.args" value:"\\*\*.ps1" field:"process.args" value:"& 'C:\oracle_unified_agent\scripts\unified-agent-permissions.ps1' ; exit $($LASTEXITCODE)" |
process.code_signature.trusted | eq | true | excludes:process.code_signature.trusted field:"process.code_signature.trusted" value:"true" |
process.executable | wildcard | ?:\Users\*\AppData\Roaming\*, ?:\ProgramData\* | excludes:process.executable field:"process.executable" value:"?:\Users\*\AppData\Roaming\*" field:"process.executable" value:"?:\ProgramData\*" |
process.command_line | match | PWMTR32V.dll,InitializeSettingsDuringInstallation, RunDll_EnableBits | excludes:process.command_line field:"process.command_line" value:"PWMTR32V.dll,InitializeSettingsDuringInstallation" field:"process.command_line" value:"RunDll_EnableBits" |
process.command_line | match | pcrpf.dll,NotifyFirmwareUpdateStaged | excludes:process.command_line field:"process.command_line" value:"pcrpf.dll,NotifyFirmwareUpdateStaged" |
process.parent.executable | eq | ?:\Windows\System32\svchost.exe | excludes:process.parent.executable field:"process.parent.executable" value:"?:\Windows\System32\svchost.exe" |
process.command_line | match | zzzzInvokeManagedCustomActionOutOfProc, tsworkspace,WorkspaceSilentSetup | excludes:process.command_line field:"process.command_line" value:"zzzzInvokeManagedCustomActionOutOfProc" field:"process.command_line" value:"tsworkspace,WorkspaceSilentSetup" |
process.command_line | match | zzzzInvokeManagedCustomActionOutOfProc | excludes:process.command_line field:"process.command_line" value:"zzzzInvokeManagedCustomActionOutOfProc" |
process.parent.name | eq | msiexec.exe | excludes:process.parent.name field:"process.parent.name" value:"msiexec.exe" |
process.command_line | wildcard | *:\Program Files\*, *:\Program Files (X86)\*, *Packages\Plugins\Microsoft.AdminCenter.AdminCenter*, *:\WINDOWS\ccmcache\*, *EEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBGADgAQQBjAHcA*, *UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAA*, *-EncodedCommand*, "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" | excludes:process.command_line |
process.name | eq | cscript.exe | excludes:process.name field:"process.name" value:"cscript.exe" |
process.parent.executable | wildcard | ?:\Program Files (x86)\*, ?:\Program Files\*, C:\Users\*\AppData\Local\Temp\is-*.tmp\*.tmp | excludes:process.parent.executable field:"process.parent.executable" value:"?:\Program Files (x86)\*" field:"process.parent.executable" value:"?:\Program Files\*" field:"process.parent.executable" value:"C:\Users\*\AppData\Local\Temp\is-*.tmp\*.tmp" |
process.parent.args | eq | -EncodedCommand | excludes:process.parent.args field:"process.parent.args" value:"-EncodedCommand" |
process.parent.args | starts_with | cABvAHcAZQByAHMAaABlAGw | excludes:process.parent.args field:"process.parent.args" value:"cABvAHcAZQByAHMAaABlAGw" |
process.parent.name | eq | powershell.exe | excludes:process.parent.name field:"process.parent.name" value:"powershell.exe" |
process.parent.code_signature.subject_name | in | FastTrack Software ApS, Grammarly, Inc., Patch My PC, LLC | excludes:process.parent.code_signature.subject_name field:"process.parent.code_signature.subject_name" value:"FastTrack Software ApS" field:"process.parent.code_signature.subject_name" value:"Grammarly, Inc." field:"process.parent.code_signature.subject_name" value:"Patch My PC, LLC" |
process.parent.code_signature.trusted | eq | true | excludes:process.parent.code_signature.trusted field:"process.parent.code_signature.trusted" value:"true" |
process.parent.executable | wildcard | ?:\Program Files (x86)\Microsoft Intune Management Extension\AgentExecutor.exe, ?:\Program Files (x86)\Spiceworks Agent Shell\AgentShellService.exe, ?:\Program Files (x86)\ITSPlatform\plugin\scripting\platform-scripting-plugin.exe, ?:\Program Files (x86)\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe, ?:\Program Files (x86)\Lenovo\VantageService\*\Lenovo.Vantage.AddinInstaller.exe, ?:\ProgramData\Lenovo\LenovoNow\Downloads\LenovoNow.Updater.exe, ?:\ProgramData\Lenovo\ImController\Plugins\LenovoFirstRunExperiencePackage\x86\LenovoWelcomeTask.exe, ?:\Program Files (x86)\Microsoft Intune Management Extension\agentexecutor.exe, C:\Banyan\Canopy\Leaf\leaf_desktop_app.exe, ?:\windows\system32\msiexec.exe, ?:\Program Files (x86)\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe, C:\Windows\CCM\OSDRunPowerShellScript.exe, C:\Windows\System32\runonce.exe | excludes:process.parent.executable |
process.parent.executable | wildcard | C:\WINDOWS\_ScriptingFramework\Modul\Engine.exe, C:\Windows\System32\gpscript.exe, C:\Windows\IMECache\*\RjImeHost.exe | excludes:process.parent.executable field:"process.parent.executable" value:"C:\WINDOWS\_ScriptingFramework\Modul\Engine.exe" field:"process.parent.executable" value:"C:\Windows\System32\gpscript.exe" field:"process.parent.executable" value:"C:\Windows\IMECache\*\RjImeHost.exe" |
user.id | eq | S-1-5-18 | excludes:user.id field:"user.id" value:"S-1-5-18" |
process.parent.command_line | match | zzzzInvokeManagedCustomActionOutOfProc | excludes:process.parent.command_line field:"process.parent.command_line" value:"zzzzInvokeManagedCustomActionOutOfProc" |
process.parent.name | eq | rundll32.exe | excludes:process.parent.name field:"process.parent.name" value:"rundll32.exe" |
process.executable | wildcard | ?:\Program Files (x86)\*.exe, ?:\Program Files\*.exe, ?:\Windows\SysWOW64\OneDriveSetup.exe, ?:\Windows\System32\MRT.exe, ?:\Users\*\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe, C:\Windows\SystemTemp\SupportAssistAgent\*\SupportAssistDeployment.exe | excludes:process.executable |
process.hash.sha256 | eq | 3d95157908cee58d19193c93c5f2b0a06910b8123a4211b0ea059ff66f2506e0, 79dbc3cf0d4cdc0f2150ab5e2bf3457ba54297202500f26f1a1d48e455f7c54a, 62d96982e2c2d58682471af9a9d0727ba49199d48b7766c318886e8e7e23670a, ef330f95416162866f5d8b9cd509066ab4168cfcc66e305006be1952905d47e6, cf635f97d0a3bea30f348277777f36db6b14aea0e7711471e5fb2e13167b80cd, 3c1169568774b7ce8a96e137983b059f030eb3983c369cfb12ea2c59cf3f56ad, edaf602006b53dc936a35d0f9e6de51c552c0203ebe814cb68b1d5cbc81f4b49, 82c97648fa358c31fb47e44762938738ad3080880b84b69d9c303d708ab160c2, 4aff93803f1915f3a10f19a1d1e065483c4d11221e3c2792b3de1807c7bf1d9a, f9e86b3a6275429f5dbecccc2020e498032a96fc02dd8bdb2a1cc5b5bf2b473b, 7b20331e03018ca74f0212aff3d5a1a66e2375188691df56c9b2b89ba84ad38b, dc3bcf4dee3b8c3ca0062284f53e5f717085bd3f3ac6b1ac70492425a7cf2474, 81fac89743d43b741a009541a9c365ed3213f49cf6314d9c50418ab0d9e82528, 7d2c761823b183cd34a8c1c0b7b6f572d26a0265bfe65afe913faf60d27de844, f943329f6399ecd418268484bc61d98887b7fc8454c2409a79adc3b965ae75a0, ae27abffcc06755840792abb83a67b847782afa01bb26c2631671ed3932930b6, 6af431b97e8571a2c072a746a44b5e0dcb3685268f75459e789063e03b7698cb, b31ed4807259472689f984e348f10e15125fae9df1298e6befddd5411a2a7dda, d0916c34fb5a3580baf74f401277ceb480eec5b4e0a61aea3400f2491922019a | excludes:process.hash.sha256 |
process.parent.executable | wildcard | C:\Windows\highsystem.NET\Client\hdnClSvc.NET.exe, C:\Program Files (x86)\AOMEI\AOMEI Backupper\*\unins*.exe, C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcconfigexec.exe, C:\Windows\highsystem.NET\Client\hdnClSvc.NET.exe, C:\Program Files (x86)\AOMEI\AOMEI Backupper\*\unins*.exe, C:\Program Files (x86)\Common Files\InstallShield\*.exe, C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe, C:\Program Files (x86)\*\unins*.exe | excludes:process.parent.executable |
Effective_process.executable | eq | C:\Windows\System32\xwizard.exe | excludes:Effective_process.executable field:"Effective_process.executable" value:"C:\Windows\System32\xwizard.exe" |
file.path | starts_with | C:\Windows\System32\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update\ | excludes:file.path field:"file.path" value:"C:\Windows\System32\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update\" |
Effective_process.executable | starts_with | \Device\Mup\ | excludes:Effective_process.executable field:"Effective_process.executable" value:"\Device\Mup\" |
file.name | starts_with | OneDrive Standalone Update Task-S-1-5-21- | excludes:file.name field:"file.name" value:"OneDrive Standalone Update Task-S-1-5-21-" |
Effective_process.name | eq | powershell.exe | excludes:Effective_process.name field:"Effective_process.name" value:"powershell.exe" |
file.name | wildcard | TSS-Framework_wsusutil, PSAppDeployToolkit_MicrosoftCorporation_* | excludes:file.name field:"file.name" value:"TSS-Framework_wsusutil" field:"file.name" value:"PSAppDeployToolkit_MicrosoftCorporation_*" |
file.path | eq | ?:\WINDOWS\System32\Tasks\PSWindowsUpdate, ?:\Windows\System32\Tasks\npcapwatchdog, ?:\Windows\System32\Tasks\ChocoUpgrade, ?:\Windows\System32\Tasks\ansible-ansible.windows.win_updates, ?:\Windows\System32\Tasks\Microsoft\Windows\PowerShell\ScheduledJobs\ansible-win-updates, ?:\WINDOWS\System32\Tasks\PRISM Monitoring - System Data, ?:\Windows\System32\Tasks\PRISM Cloud Monitoring - System Data | excludes:file.path |
Effective_process.name | eq | winword.exe, excel.exe, powerpnt.exe | excludes:Effective_process.name field:"Effective_process.name" value:"winword.exe" field:"Effective_process.name" value:"excel.exe" field:"Effective_process.name" value:"powerpnt.exe" |
file.name | starts_with | Microsoft Office 1? Sync Maintenance for | excludes:file.name field:"file.name" value:"Microsoft Office 1? Sync Maintenance for " |
file.size | ge | 5200 | excludes:file.size field:"file.size" value:"5200" |
file.size | le | 5300 | excludes:file.size field:"file.size" value:"5300" |
Indicators
These rows show field, operator, and value matches.