Suspicious Scheduled Task Registry Modification

[rule]
description = """
Identifies the modification of a scheduled task registry key by an unusual process. This behavior is consistent with an
adversary attempting to persist or execute via scheduled tasks while avoiding generating event logs.
"""
id = "817af31e-a360-44eb-9019-e694395627d1"
license = "Elastic License v2"
name = "Suspicious Scheduled Task Registry Modification"
os_list = ["windows"]
reference = ["https://github.com/netero1010/GhostTask/"]
version = "1.0.7"

query = '''
registry where event.action == "modification" and registry.data.strings != "null" and process.executable != null and 
 process.thread.Ext.call_stack_summary  : "?*" and 
 registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*Actions*" and 
 not (process.executable : ("?:\\Windows\\system32\\svchost.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe") and 
      process.thread.Ext.call_stack_summary : ("*schedsvc.dll*", "*Unknown*"))  and
 not process.executable : "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe"
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.005"
name = "Scheduled Task"
reference = "https://attack.mitre.org/techniques/T1053/005/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"