Create_Modify Schtasks (Sysmon)

Group by: _time, command_line, host
Source: github.com/anvilogic-forge/armory

Detects possible persistent backdoor access using schtasks -- Threat Group Association: Actinium/Gamaredon/Primitive Bear, Alloy Taurus/Gallium, APT29/Nobelium/Cozy Bear, APT31, APT33, APT34/OilRig, APT35/Phosphorus/Magic Hound, APT41, APT43, BlackByte, BlackCat, Blind Eagle/APT-C-36, Evilnum, FIN7, FIN12, Gamaredon Group/Shuckworm, GoldenJackal, Lazarus, Memento Team, MuddyWater, Redfly, TA428, Turla (akaSecret Blizzard, KRYPTON, and UAC-0003), Vice Society, WinterVivern/UAC-0114, WIRTE, Witchetty

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task

References

https://attack.mitre.org/techniques/T1053/005/

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '1071.1108'
title: Create_Modify Schtasks
description: 'Detects possible persistent backdoor access using schtasks -- Threat
  Group Association: Actinium/Gamaredon/Primitive Bear, Alloy Taurus/Gallium, APT29/Nobelium/Cozy
  Bear, APT31, APT33, APT34/OilRig, APT35/Phosphorus/Magic Hound, APT41, APT43, BlackByte,
  BlackCat, Blind Eagle/APT-C-36, Evilnum, FIN7, FIN12, Gamaredon Group/Shuckworm,
  GoldenJackal, Lazarus, Memento Team, MuddyWater, Redfly, TA428, Turla (akaSecret
  Blizzard, KRYPTON, and UAC-0003), Vice Society, WinterVivern/UAC-0114, WIRTE, Witchetty
  - Software Association: Blackbyte, Black Basta, BianLian, Cactus, Conti, GoMet,
  HermeticWiper/Trojan.Killdisk, Lockbit, Lorenz, LV, NanoCore, Play, Prestige, Prometheus/Spook,
  Rhysida, Trickbot, XingLocker - Atomics T1036.004 Test #1 Atomics T1053.005 Test#1
  Atomics T1053.005 Test#2 Atomics T1053.005 Test#3 Atomics T1053.005 Test#4 - #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 TERM("schtasks")
  (TERM("create") OR TERM("change")) | table _time, host, user process, process_*,
  parent_process, parent_process_* | bin span=1s | stats values(*) as * by _time,
  host, process | where len(parent_process_name)>0 AND match(process,"(?i)\s+(\/create)|(\/change)") '
techniques:
- execution:scheduled task/job:scheduled task
- persistence:scheduled task/job:scheduled task
technique_id:
- T1053.005
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1053/005/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 TERM("schtasks") (TERM("create") OR TERM("change"))

Stage 2: `table`

| table _time, host, user process, process_*, parent_process, parent_process_*

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host, process

Stage 5: `where`

| where len(parent_process_name)>0 AND match(process,"(?i)\s+(\/create)|(\/change)")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`process`	regex_match	`"(?i)\s+(\/create)` `(\/change)"`	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"schtasks"`
1	`"create"`
1	`"change"`