title: Windows 10 Scheduled Task SandboxEscaper 0-day
id: 931b6802-d6a6-4267-9ffa-526f57f22aaf
status: test
description: Detects Task Scheduler .job import arbitrary DACL write\par
author: Olaf Hartong
references:
  - https://github.com/SandboxEscaper/polarbearrepo/tree/master/bearlpe
date: 2019/05/22
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:
      - '/change'
      - '/TN'
      - '/RU'
      - '/RP'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.privilege_escalation
  - attack.t1053.005
  - car.2013-08-001
