Scheduled Task Executing Payload from Registry

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task `T1059.001` Command and Scripting Interpreter: PowerShell
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Scheduled Task Executing Payload from Registry
id: 86588b36-c6d3-465f-9cee-8f9093e07798
related:
    - id: c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78
      type: derived
status: test
description: Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.
references:
    - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2023-07-18
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        # schtasks.exe /Create /F /TN "{97F2F70B-10D1-4447-A2F3-9B070C86E261}" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\SOFTWARE\Pvoeooxf).yzbbvhhdypa))) " /SC MINUTE /MO 30
        - Image|endswith: '\schtasks.exe'
        - OriginalFileName: 'schtasks.exe'
    selection_cli_create:
        CommandLine|contains: '/Create'
    selection_cli_get:
        CommandLine|contains:
            - 'Get-ItemProperty'
            - ' gp ' # Alias
    selection_cli_hive:
        CommandLine|contains:
            - 'HKCU:'
            - 'HKLM:'
            - 'registry::'
            - 'HKEY_'
    filter_main_encoding:
        CommandLine|contains:
            - 'FromBase64String'
            - 'encodedcommand'
    condition: all of selection_* and not 1 of filter_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\schtasks.exe'
    - OriginalFileName: 'schtasks.exe'

Stage 2: `selection_cli_create`

selection_cli_create:
    CommandLine|contains: '/Create'

Stage 3: `selection_cli_get`

selection_cli_get:
    CommandLine|contains:
        - 'Get-ItemProperty'
        - ' gp '

Stage 4: `selection_cli_hive`

selection_cli_hive:
    CommandLine|contains:
        - 'HKCU:'
        - 'HKLM:'
        - 'registry::'
        - 'HKEY_'

Stage 5: `not filter_main_encoding`

filter_main_encoding:
    CommandLine|contains:
        - 'FromBase64String'
        - 'encodedcommand'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`FromBase64String`	`excludes:CommandLine` `field:"CommandLine" value:"FromBase64String"`
`CommandLine`	match	`encodedcommand`	`excludes:CommandLine` `field:"CommandLine" value:"encodedcommand"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`gp` corpus 2 (sigma 2) `/Create` corpus 9 (sigma 6, splunk 2, kusto 1) `Get-ItemProperty` corpus 2 (sigma 2) `HKCU:` corpus 2 (sigma 2) `HKEY_` corpus 2 (sigma 2) `HKLM:` corpus 2 (sigma 2) `registry::` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\schtasks.exe` corpus 55 (sigma 55)	`field:"Image" kind:ends_with value:"\schtasks.exe"`
`OriginalFileName`	eq	`schtasks.exe` corpus 31 (sigma 18, elastic 9, splunk 4)	`field:"OriginalFileName" kind:eq value:"schtasks.exe"`

Scheduled Task Executing Payload from Registry

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli_create

Stage 3: selection_cli_get

Stage 4: selection_cli_hive

Stage 5: not filter_main_encoding