Schtasks Creation Or Modification With SYSTEM Privileges

Title: Schtasks Creation Or Modification With SYSTEM Privileges
Status: test
Description:Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges
References:
  -https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-28
modified:2025-02-15
Tags:

• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.persistence'
• -'attack.t1053.005'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_root:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:
      -' /change '
      -' /create '

  selection_run:
    CommandLine|contains: '/ru '
  selection_user:
    CommandLine|contains:
      -'NT AUT'
      -' SYSTEM '

  filter_optional_teamviewer:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:
      -'/TN TVInstallRestore'
      -'\TeamViewer_.exe'

  filter_optional_office:
    CommandLine|contains|all:
      -'Subscription Heartbeat'
      -'\HeartbeatConfig.xml'
      -'\Microsoft Shared\OFFICE'

  filter_optional_avira:
    CommandLine|contains:
      -'/Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR '
      -':\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe'
      -'/VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART" /RL HIGHEST'

  condition:all of selection_* and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: high