phantinuss
2f9b90584c
fix: Potentially Suspicious AccessMask Requested From LSASS - FP with Avira from Windows temp folder fix: Direct Syscall of NtOpenProcess - FP with another Firefox process and removing drive letters fix: Control Panel Items - FP with command line observed from taskhost.exe fix: Rundll32 Execution Without DLL File - remove non-essential ParentCommandLine dependency in filter fix: Schtasks Creation Or Modification With SYSTEM Privileges - remove non-essential ParentImage dependency in filter fix: Suspicious Elevated System Shell - remove non-essential ParentImage dependency in filter fix: Suspicious Elevated System Shell - FP with Avira update utility fix: Execution of Suspicious File Type Extension - FP with OpenOffice --------- Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
49 lines
1.8 KiB
YAML
49 lines
1.8 KiB
YAML
title: Schtasks Creation Or Modification With SYSTEM Privileges
|
|
id: 89ca78fd-b37c-4310-b3d3-81a023f83936
|
|
status: experimental
|
|
description: Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges
|
|
references:
|
|
- https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern
|
|
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks
|
|
author: Nasreddine Bencherchali (Nextron Systems)
|
|
date: 2022/07/28
|
|
modified: 2023/10/11
|
|
tags:
|
|
- attack.execution
|
|
- attack.persistence
|
|
- attack.t1053.005
|
|
logsource:
|
|
product: windows
|
|
category: process_creation
|
|
detection:
|
|
selection_root:
|
|
Image|endswith: '\schtasks.exe'
|
|
CommandLine|contains:
|
|
- ' /change '
|
|
- ' /create '
|
|
selection_run:
|
|
CommandLine|contains: '/ru '
|
|
selection_user:
|
|
CommandLine|contains:
|
|
- 'NT AUT' # This covers the usual NT AUTHORITY\SYSTEM
|
|
- ' SYSTEM ' # SYSTEM is a valid value for schtasks hence it gets it's own value with space
|
|
filter_optional_teamviewer:
|
|
# FP from test set in SIGMA
|
|
# Cannot use ParentImage on all OSes for 4688 events
|
|
# ParentImage|contains|all:
|
|
# - '\AppData\Local\Temp\'
|
|
# - 'TeamViewer_.exe'
|
|
Image|endswith: '\schtasks.exe'
|
|
CommandLine|contains|all:
|
|
- '/TN TVInstallRestore'
|
|
- '\TeamViewer_.exe'
|
|
filter_optional_avira:
|
|
CommandLine|contains:
|
|
- '/Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR '
|
|
- ':\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe'
|
|
- '/VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART" /RL HIGHEST'
|
|
condition: all of selection_* and not 1 of filter_optional_*
|
|
falsepositives:
|
|
- Unknown
|
|
level: high
|