Suspicious Scheduled Task Creation via Masqueraded XML File

Title: Suspicious Scheduled Task Creation via Masqueraded XML File
Status: test
Description:Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence
References:
  -https://learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-
  -https://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml
Author: Swachchhanda Shrawan Poudel, Elastic (idea)
Date: 2023-04-20
modified:2024-12-01
Tags:

• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.persistence'
• -'attack.stealth'
• -'attack.t1036.005'
• -'attack.t1053.005'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
Image|endswith:'\schtasks.exe' OriginalFileName:'schtasks.exe'   selection_cli_create:
    CommandLine|contains:
      -'/create'
      -'-create'

  selection_cli_xml:
    CommandLine|contains:
      -'/xml'
      -'-xml'

  filter_main_extension_xml:
    CommandLine|contains: '.xml'
  filter_main_system_process:
    IntegrityLevel:
      -'System'
      -'S-1-16-16384'

  filter_main_rundll32:
    ParentImage|endswith: '\rundll32.exe'
    ParentCommandLine|contains|all:
      -':\WINDOWS\Installer\MSI'
      -'.tmp,zzzzInvokeManagedCustomActionOutOfProc'

  filter_optional_third_party:
    ParentImage|endswith:
      -':\ProgramData\OEM\UpgradeTool\CareCenter_*\BUnzip\Setup_msi.exe'
      -':\Program Files\Axis Communications\AXIS Camera Station\SetupActions.exe'
      -':\Program Files\Axis Communications\AXIS Device Manager\AdmSetupActions.exe'
      -':\Program Files (x86)\Zemana\AntiMalware\AntiMalware.exe'
      -':\Program Files\Dell\SupportAssist\pcdrcui.exe'

  condition:all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: medium