Scheduled Task Creation via Unsigned Parent

[rule]
description = """
Identifies the creation of a scheduled task using schtasks.exe utility and from a recently dropped unsigned parent
process. This behavior is consistent with an adversary attempting to establish persistence.
"""
id = "bcafc042-2aaa-4011-8650-1621e3bd6807"
license = "Elastic License v2"
name = "Scheduled Task Creation via Unsigned Parent"
os_list = ["windows"]
reference = ["https://docs.microsoft.com/en-us/windows/win32/taskschd"]
version = "1.0.16"

query = '''
sequence by user.id with maxspan=3m
 [process where event.action == "start" and
  (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
  not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
  not process.hash.sha256 : ("d0766b7caa8a7ee828f776116e564e5f231307cb748eb4b9164fa679a88185ca",
                             "6b509b774512fcd3581c321040119bf412a308c20d681575170a3a21078225b7",
                             "84efcc024b5f6de6554c40033462b21ca550a240c84e46b36ebb972799aa8a8b",
                             "5781e4524a79859f2f5097829d5a848a47529181a0cc34342f298d77ab31209f",
                             "7e2afab5c7bda9ed6b308807757dbd5aecd572a02edb540b7cb8c98865d21278",
                             "d678d9b1ecb942d88c39c23cd93884b28f6fe0792e2a122e8f1b00c2e34dde27",
                             "830b7954516ca041fe9aba5e472023002236773aa9f2482a2025706b4536b8d0")
  ] by process.entity_id
 [process where event.action == "start" and
  (process.pe.original_file_name : ("schtasks.exe", "sctasks.exe", "cmd.exe", "powershell.exe") or 
   process.name : ("schtasks.exe", "cmd.exe", "powershell.exe")) and
  not process.Ext.token.integrity_level_name == "system" and
  process.args : ("/create", "-create") and process.args : "/tr"] by process.parent.entity_id
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.005"
name = "Scheduled Task"
reference = "https://attack.mitre.org/techniques/T1053/005/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.4.0"