Suspicious Scheduled Task Name As GUID

Title: Suspicious Scheduled Task Name As GUID
Status: test
Description:Detects creation of a scheduled task with a GUID like name
References:
  -https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
  -https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-31
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.t1053.005'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains: '/Create '
  selection_tn:
    CommandLine|contains:
      -'/TN "{'
      -'/TN '{'
      -'/TN {'

  selection_end:
    CommandLine|contains:
      -'}"'
      -'}''
      -'} '

  condition:all of selection_*
Falsepositives:
  -Legitimate software naming their tasks as GUIDs
Level: medium