detection.wiki

Detection rules › Sigma

Scheduled Task Executed Uncommon LOLBIN

Status
test
Severity
medium
Log source
product windows, service taskscheduler
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1053.005 Scheduled Task/Job: Scheduled Task
PersistenceT1053.005 Scheduled Task/Job: Scheduled Task
Privilege EscalationT1053.005 Scheduled Task/Job: Scheduled Task

Event coverage

ProviderEventTitle
TaskSchedulerEvent ID 129Task Scheduler launch task "Name" , instance "TaskName" with process ID Path.

Rule body yaml

title: Scheduled Task Executed Uncommon LOLBIN
id: f0767f15-0fb3-44b9-851e-e8d9a6d0005d
status: test
description: Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-05
modified: 2023-02-07
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
logsource:
    product: windows
    service: taskscheduler
    definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
    selection:
        EventID: 129 # Created Task Process
        Path|endswith:
            - '\calc.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\mspaint.exe'
            - '\notepad.exe'
            - '\regsvr32.exe'
            # - '\rundll32.exe'
            - '\wscript.exe'
    # filter_system:
    #     Path|endswith: '\rundll32.exe'
    #     TaskName|startswith: '\Microsoft\Windows\'
    # condition: selection and not 1 of filter_*
    condition: selection
falsepositives:
    - False positives may occur with some of the selected binaries if you have tasks using them (which could be very common in your environment). Exclude all the specific trusted tasks before using this rule
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    EventID: 129
    Path|endswith:
        - '\calc.exe'
        - '\cscript.exe'
        - '\mshta.exe'
        - '\mspaint.exe'
        - '\notepad.exe'
        - '\regsvr32.exe'
        - '\wscript.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Pathends_with
  • \calc.exe
  • \cscript.exe
  • \mshta.exe
  • \mspaint.exe
  • \notepad.exe
  • \regsvr32.exe
  • \wscript.exe