Interactive privileged shell triggered by schedule task (deprecated)

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker abuse the at command to elevate privilages. Note that at command is deprecated since Windows 8 and replaced by schtask.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Interactive privileged shell triggered by schedule task (deprecated)
description: Detects scenarios where an attacker abuse the at command to elevate privilages. Note that at command is deprecated since Windows 8 and replaced by schtask.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1053.005-Scheduled%20Task
- https://docs.microsoft.com/en-us/troubleshoot/windows-client/system-management-components/use-at-command-to-schedule-tasks
- https://strontic.github.io/xcyclopedia/library/at.exe-5FD22B915C232378E567160D641CC9F2.html
- https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html
- https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html
- https://www.linkedin.com/pulse/lolbin-attacks-scheduled-tasks-t1503005-how-detect-them-v%C3%B6gele
tags:
- attack.execution
- attack.t1053.005
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    EventID: 4688
    NewProcessName|endswith: \cmd.exe
    CommandLine|contains|all:
      - at
      - interactive
      - cmd
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 4688
  NewProcessName|endswith: \cmd.exe
  CommandLine|contains|all:
    - at
    - interactive
    - cmd

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`at` `cmd` corpus 8 (sigma 8) `interactive` corpus 3 (sigma 3)	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\cmd.exe` corpus 130 (sigma 130)	`field:"Image" kind:ends_with value:"\cmd.exe"`