Suspicious Command Patterns In Scheduled Task Creation

Title: Suspicious Command Patterns In Scheduled Task Creation
Status: test
Description:Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands
References:
  -https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/
  -https://twitter.com/RedDrip7/status/1506480588827467785
  -https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
Author: Florian Roth (Nextron Systems)
Date: 2022-02-23
modified:2024-03-19
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.t1053.005'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains: '/Create '
  selection_pattern_1:
    CommandLine|contains:
      -'/sc minute '
      -'/ru system '

  selection_pattern_2:
    CommandLine|contains:
      -'cmd /c'
      -'cmd /k'
      -'cmd /r'
      -'cmd.exe /c '
      -'cmd.exe /k '
      -'cmd.exe /r '

  selection_uncommon:
    CommandLine|contains:
      -' -decode '
      -' -enc '
      -' -w hidden '
      -' bypass '
      -' IEX'
      -'.DownloadData'
      -'.DownloadFile'
      -'.DownloadString'
      -'/c start /min '
      -'FromBase64String'
      -'mshta http'
      -'mshta.exe http'

  selection_anomaly_1:
    CommandLine|contains:
      -':\ProgramData\'
      -':\Temp\'
      -':\Tmp\'
      -':\Users\Public\'
      -':\Windows\Temp\'
      -'\AppData\'
      -'%AppData%'
      -'%Temp%'
      -'%tmp%'

  selection_anomaly_2:
    CommandLine|contains:
      -'cscript'
      -'curl'
      -'wscript'

  condition:selection_schtasks and ( all of selection_pattern_* or selection_uncommon or all of selection_anomaly_* )
Falsepositives:
  -Software installers that run from temporary folders and also install scheduled tasks are expected to generate some false positives
Level: high