Detection rules › Sigma
Scheduled task created and deleted fastly (ATexec.py)
Detects scenarios where an attacker abuse task scheduler capacities to execute commands or elevate privileges.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1053.005 Scheduled Task/Job: Scheduled Task |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4698 | A scheduled task was created. |
| Security-Auditing | Event ID 4699 | A scheduled task was deleted. |
Rule body yaml
title: Scheduled task created and deleted fastly (ATexec.py)
description: Detects scenarios where an attacker abuse task scheduler capacities to execute commands or elevate privileges.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1053.005-Scheduled%20Task
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py
- https://u0041.co/blog/post/1
- https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html
tags:
- attack.execution
- attack.t1053.005 # Scheduled Task/Job: Scheduled Task
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection_create:
EventID: 4698
selection_delete:
EventID: 4699
#filter:
# SubjectUserSid: 'S-1-5-18'
condition: selection_create > selection_delete | group(Computer, TaskName)
timeframe: 5m
falsepositives:
- Rare application activity
level: high
Stages and Predicates
Stage 0: condition
selection_create > selection_delete | group(Computer, TaskName)Stage 1: selection_create
selection_create:
EventID: 4698
Stage 2: selection_delete
selection_delete:
EventID: 4699