Scheduled Task from a Browser or Compression Utility Descendant

[rule]
description = """
Identifies the creation of a scheduled task by a descendant of a browser or compression utility. This behavior is
consistent with an adversary attempting to establish persistence after initial access via malicious user execution.
"""
id = "21cd57eb-b211-4f06-8e4e-cdafa4fdb8ca"
license = "Elastic License v2"
name = "Scheduled Task from a Browser or Compression Utility Descendant"
os_list = ["windows"]
reference = ["https://docs.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-"]
version = "1.0.20"

query = '''
sequence with maxspan=5m
 [process where event.action == "start" and
 (process.Ext.relative_file_creation_time <= 1800 or process.Ext.relative_file_name_modify_time <= 1800) and
 (process.code_signature.trusted == false or process.code_signature.exists==false) and
 not process.code_signature.status : ("errorExpired", "errorCode_endpoint*") and

 /* Direct Child */
 (
  (process.executable : ("?:\\Users\\*\\Downloads\\*", "*\\AppData\\Local\\Temp\\*") and
   process.parent.name: ("explorer.exe", "chrome.exe", "msedge.exe", "firefox.exe", "7zFM.exe", "iexplore.exe", "winrar.exe")) or

 /* Descendant */
  descendant of [
  process where event.action == "start" and
  (process.code_signature.trusted == false or process.code_signature.exists==false)
  and process.parent.name: ("explorer.exe", "chrome.exe", "msedge.exe", "firefox.exe", "7zFM.exe", "iexplore.exe", "winrar.exe") and
  process.executable: ("*\\Downloads\\*", "*\\AppData\\Local\\Temp\\*") and
  process.pe.original_file_name != "Adobe Installer" and
  not process.hash.sha256 :
                  ("aaeaae8a88cab0ff1401e8c8e0fca3d92c758844e17b198355951c8fc842ccaa",
                   "62925978d2c0de2c69801302eb7040cb633068a44cd83415d15f8c25f5bebff6",
                   "be7beb3d9b8c56e1395bfee0d31503e0156eeba0312d385ca77068b95d1d4bea",
                   "c3ab138aa176fda1a43e3a38d376e8ec284b610d9dacb9db0d08e503d071e4fe",
                   "52e1e3053aadaccf78837dffaaa6f9ed41b201e0019f22a4880a5327d7650206",
                   "a6296af76588a81448c2e7dced89daa29a4eba92a0ce7e5da2b868cd6e511bda")
  ]
 ) and
 not (process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and process.code_signature.trusted == true) and
 process.pe.imphash != "28a18f58924d2f4dd2bffbbc85a12952"
 ] by process.entity_id
 [file where event.action : "creation" and process.name : "svchost.exe" and
  file.path : ("?:\\Windows\\Tasks\\*", "?:\\Windows\\System32\\Tasks\\*")] by Effective_process.entity_id
'''

min_endpoint_version = "8.6.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.005"
name = "Scheduled Task"
reference = "https://attack.mitre.org/techniques/T1053/005/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.6.0"