security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update proc_creation_win_susp_schtasks_disable.yml

Browse Source
This commit is contained in:
Nasreddine Bencherchali
2022-09-02 14:39:52 +02:00
parent 927b29e85a
commit f6026b6972
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_susp_schtasks_disable.yml
+5 -2
View File
@@ -2,13 +2,13 @@ title: Disable Important Scheduled Task
id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980
status: experimental
description: Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange, SQL Server...etc.
author: frack113
author: frack113, Nasreddine Bencherchali
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task
- https://twitter.com/MichalKoczwara/status/1553634816016498688
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
date: 2021/12/26
modified: 2022/08/01
modified: 2022/09/02
logsource:
category: process_creation
product: windows
@@ -24,6 +24,9 @@ detection:
- 'Microsoft\Windows\SystemRestore\SR'
- 'Microsoft\Windows\Windows Defender\'
- 'Microsoft\Windows\BitLocker'
- 'Microsoft\Windows\WindowsBackup\'
- 'Microsoft\Windows\WindowsUpdate\'
- 'Microsoft\Windows\UpdateOrchestrator\'
- 'Windows\ExploitGuard'
condition: all of schtasks_*
falsepositives: