Suspicious Windows Schedule Child Process

[rule]
description = """
Identifies suspicious child processes of the Windows Schedule service. This behavior is consistent with an adversary
executing malicious code or commands via an existing scheduled task.
"""
id = "eb04896b-935f-4d12-b2ad-579db82e1f42"
license = "Elastic License v2"
name = "Suspicious Windows Schedule Child Process"
os_list = ["windows"]
version = "1.0.40"

query = '''
process where event.action == "start" and
 process.parent.name == "svchost.exe" and process.parent.args == "Schedule" and process.hash.sha256 != null and 
 (
  /* non noisy child processes */
  process.pe.original_file_name : ("MSHTA.EXE", "MSBuild.exe", "InstallUtil.exe") or

  /* suspicious path */
  (process.executable : ("?:\\Users\\Public\\*", "?:\\Windows\\Tasks\\*", "?:\\Windows\\system32\\tasks\\*") and
   process.hash.sha256 != null and (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500)) or

  /* potentially noisy child processes */

  /* Powershell with encoded long command_line */
  (process.pe.original_file_name == "PowerShellx.EXE" and length(process.command_line) >= 200 and process.command_line : ("* -enc*", "* -e *")) or

  /* Powershell with common suspicious args */
  (process.pe.original_file_name == "PowerShell.EXE" and
  process.command_line : ("bypass", "*HKCU*", "* IEX*", "*^*^*^*^*^*^*^*", "*.replace*", "*Reflection.Assembly*", "*set *set *set *", "*Frombase64String*", "*::Load*")) or

  /* Windows Command Shell */
  (process.pe.original_file_name == "Cmd.Exe" and not user.id == "S-1-5-18" and
   process.args : ("?:\\Users\\Public\\*", "?:\\Users\\*\\AppData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*", "?:\\Windows\\system32\\tasks\\*") and
   not (process.args : "?:\\Users\\*\\AppData\\Local\\IBM\\Notes\\Data\\Cache.NDK" and process.args : "del")) or

  /* Rundll32 running DLL from a user writable folder or with DLL export by ordinal */
  (process.pe.original_file_name == "RUNDLL32.EXE" and process.args : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "*,#*")) or

  /* unsiged and from users writable folders */
  (process.code_signature.exists == false and
   (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
   process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*", "?:\\Windows\\system32\\tasks\\*"))
 ) and

 /* noisy patterns */
  not (process.name : "powershell.exe" and process.args : "https://*.accellis.com*" and process.args : "-Locationid") and
  not (process.name : "powershell.exe" and user.id == "S-1-5-18" and
       process.args: ("*Get-AuthenticodeSignature*", "LTService", "LTSvcMon", "?:\\Adminbatch\\scripts\\winrm-https-listener-setup.ps1")) and
  not (process.name : "powershell.exe" and process.args == "-UseBasicParsing" and process.args == "-UserAgent" and user.id == "S-1-5-18") and
  not (process.pe.original_file_name in ("SigniantApp.exe", "G2M.exe", "DragonCenter_Updater.exe", "msedgeupdate.dll", "msrdcw.exe") and
       process.code_signature.subject_name in ("Signiant Corporation", "LogMeIn, Inc.", "Micro-Star International CO., LTD.", "Microsoft Corporation")) and
  not (process.pe.original_file_name == "OneDriveStandaloneUpdater.exe" and
       process.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveStandaloneUpdater.exe") and

  /* many signed legit third party programs executed as scheduled task  */
  not (process.code_signature.trusted == true and process.executable : "?:\\Users\\*\\AppData\\*") and
  not process.code_signature.subject_name in ("win.acme.simple@gmail.com", "NCH Software, Inc.", "RealNetworks, Inc.",
                                              "WATERFOX LIMITED", "YY Inc.", "web discover", "WACS",
                                              "Western Digital Technologies, Inc.") and
  not process.hash.sha256 in
              ("18fb4e476f670b532d5227fc8ff9d7d55c151102875d64e80f2dc0cbd569861c",
               "3a87ed304e359392da91bc39cb17af379dcd906c045ffcc4d715086d766acfbc",
               "c0593b4b65bb264a982d61a7b84f38b10a41972b49a217ef3a80a906a0c4ee08",
               "41512ecc47bb39b9f39c808f89ab23df4a4e88e414215553b825e140a4509946",
               "cee7f094fc78679b673f07702cfd403b540e537de8d5b9c6c98e2b24610f9805",
               "15eaff644e9a34e49997d57c4c21ce18dab4714321a62eae4252bd8eca1f3f9d",
               "fe0ecd844393d78026fd41a5b5bb9ab577a483ec1c290566a3fbdbf52fb24fc5",
               "053c6a0f59672b06e9ebccff18f2517780ff4c77ada25ac3eee1f2c4a24e8aea",
               "1a6b98956fb92a8a57b56feeef6fedc26b95c809526374f6e7c22acd8e3925c3",
               "554fa8a3bf2e233f64d9e000bf30f197159406fbfa9920adca0901a265e45379", 
               "fb0ecac0bd7b8f3d81dffb359fb1449fc3cb74a15a1f53a568c1c5ee5a8966a9", 
               "cf635f97d0a3bea30f348277777f36db6b14aea0e7711471e5fb2e13167b80cd", 
               "22e7528e56dffaa26cfe722994655686c90824b13eb51184abfe44d4e95d473f",
               "97fc042ea077118a6bb19641d7c1e8fb20e6d1714f2234110f88a47722bcf75e",
               "47ffb3d3e793d11a029d83f77e7c02d91af275116ef8f28a5699b64b6386c91c",
               "02a31b0fcb2603643518fb1a164a7a2abe8f3f494daf88ebc3d93c9b98a50e46") and

  not process.executable :
             ("?:\\Users\\*\\AppData\\Local\\GoToMeeting\\*\\g2mupload.exe",
              "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveStandaloneUpdater.exe",
              "?:\\Users\\*\\AppData\\Local\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe",
              "?:\\Users\\*\\AppData\\Local\\Google\\Update\\GoogleUpdate.exe") and

  not (process.name : "powershell.exe" and
       process.args : ("Invoke-WebRequest http://sms.revize.com/*", "Import-Module PSScheduledJob; $jobDef*", "$w = $env:APPDATA*",
                       "[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes('Newtonsoft.Json.dll*",
                       "$f=$env:APPDATA+'\\Browser Assistant\\*",
                       "& ((Get-ItemProperty -Path 'HKCU:\\\\Control Panel\\\\Desktop').SCRNSAVE.EXE)",
                       "($wc.DownloadString(https://install.mondoo.com/ps1));",
                       "Remove-Item HKCU:\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\tel\\UserChoice -Recurse -Force -ErrorAction SilentlyContinue",
                       "$h=Get-Content -Path 'BE.txt' -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^', '0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.BrowserExtension.S]::Start()",
                       "Set-ItemProperty -Path 'HKCU:\\Control Panel\\Desktop' -Name Wallpaper -Value 'C:\\*.jpg'\nSet-ItemProperty -Path 'HKCU:\\Control Panel\\Desktop' -Name WallpaperStyle -Value 2\nRUNDLL32.EXE user32.dll, UpdatePerUserSystemParameters")) and
  not (process.name : ("rundll32.exe", "regsvr32.exe") and
       process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\windows\\system32\\mmcndmgr.dll", 
                       "dfshim.dll,ShOpenVerbShortcut", "Files\\McAfee\\Agent\\\\ma_aac_service.dll,", 
                       "?:\\ProgramData\\Lenovo\\Vantage\\Addins\\ThinkSpectrumAddin\\*\\Spectrum_Core.dll,RunDLL", 
                       "?:\\Windows\\System32\\dfshim.dll,ShOpenVerbApplication")) and
  not (process.name : "cmd.exe" and 
       process.args : ("C:\\Users\\Public\\*.bat",
                       "Client\\props\\schedule-nojava.cmd",
                       "rmdir")) and
  not (process.name : "mshta.exe" and
       process.args : ("*\\Support\\AzureVirtualDesktop\\ImageSources\\DisableTeamsAutoStart.ps1*",
                       "*\\Program Files (x86)\\combit\\*\\ServicePackNotification.ps1*")) and 
  not (process.name : "powershell.exe" and user.id == "S-1-5-18" and process.command_line : "*\\ProgramData\\ServiceNow\\agent-client-collector\\config\\acc.yml*")
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"

[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.005"
name = "Scheduled Task"
reference = "https://attack.mitre.org/techniques/T1053/005/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1216"
name = "System Script Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1216/"

[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.003"
name = "CMSTP"
reference = "https://attack.mitre.org/techniques/T1218/003/"

[[threat.technique.subtechnique]]
id = "T1218.004"
name = "InstallUtil"
reference = "https://attack.mitre.org/techniques/T1218/004/"

[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"

[[threat.technique.subtechnique]]
id = "T1218.009"
name = "Regsvcs/Regasm"
reference = "https://attack.mitre.org/techniques/T1218/009/"

[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"

[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"


[[threat.technique]]
id = "T1220"
name = "XSL Script Processing"
reference = "https://attack.mitre.org/techniques/T1220/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"